Function at 0x1400c5cd0
Capabilities:
Encode data using xor
Execute command
Schedule task via at
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5b0
mov rax, qword [0x140330440]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x110], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r8d, [r13 + 0xb]
lea rdx, str.loginFields
lea rcx, [rsp + 0x40]
call fcn.140070cc0
nop
lea rdx, [rsp + 0x40]
call fcn.14006d880
cmp qword [rax + 0x18], 0x24
jb 0x1400c5d6d
mov rbx, qword [rax]
mov qword [rax + 0x10], Ordinal_41
lea r8d, [r13 + 0x24]
lea rdx, str.version4.55platform0protocol207
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x24], r13b
jmp 0x1400c5d82
lea r9, str.version4.55platform0protocol207
mov edx, 0x24
mov rcx, rax
call fcn.140070b60
nop
lea rcx, [rsp + 0x40]
call fcn.14005d600
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x270]
call sub.VCRUNTIME140.dll_memset
mov r8d, 1
lea rdx, str.proxy.txt
lea rcx, [rsp + 0x270]
call fcn.1400c8b00
nop
cmp qword [rsp + 0x300], 0
je 0x1400c5fbe
xorps xmm0, xmm0
movups xmmword [rsp + 0x178], xmm0
movdqa xmm1, xmmword [0x140302720]
movdqu xmmword [rsp + 0x188], xmm1
mov byte [rsp + 0x178], 0
mov rax, qword [rsp + 0x270]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x270]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x270]
call fcn.140071e00
lea rsi, [rsp + 0x178]
mov r8, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x190]
cmp rdx, 0xf
cmova rsi, r8
add rsi, qword [rsp + 0x188]
lea rbx, [rsp + 0x178]
cmp rdx, 0xf
cmova rbx, r8
add rbx, qword [rsp + 0x188]
lea rcx, [rsp + 0x178]
cmp rdx, 0xf
cmova rcx, r8
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rbx
call fcn.1402645c0
mov r8, rax
cmp rax, rbx
je 0x1400c5ea8
inc rax
cmp rax, rbx
je 0x1400c5ea8
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x1400c5ea0
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x1400c5e92
lea rax, [rsp + 0x178]
cmp qword [rsp + 0x190], 0xf
cmova rax, qword [rsp + 0x178]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rsp + 0x188]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0xf
cmova rcx, qword [rsp + 0x178]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x188], rbx
cmp rbx, 5
jbe 0x1400c5f7a
lea rdx, [rsp + 0x178]
call fcn.1400e6e40
lea rdx, str.Proxy_has_been_set
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0xf
cmova rdx, qword [rsp + 0x178]
mov r8, qword [rsp + 0x188]
mov rcx, rax
call fcn.140071fa0
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x280]
call fcn.1400c99f0
test rax, rax
jne 0x1400c5fb1
mov rax, qword [rsp + 0x270]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x270]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x178]
call fcn.14005d600
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1e8], xmm1
xor r8d, r8d
lea rdx, [0x1402fb157]
lea rcx, [rsp + 0x1d8]
call fcn.140070cc0
nop
mov rax, qword [0x14033d460]
movzx ecx, word [rax + 0x90]
test cx, cx
je 0x1400c641b
mov r8d, ecx
lea r9, [rsp + 0x105]
nop
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1400c6010
lea r8, [rsp + 0x105]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.14005dd70
nop
mov word [rsp + 0x30], __WSAFDIsSet
mov byte [rsp + 0x32], 1
mov rax, qword [0x14033d460]
mov rdx, qword [rax + 0x88]
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x128], xmm1
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400c6090
lea rcx, [rsp + 0x118]
call fcn.140070cc0
nop
cmp byte [rsp + 0x32], 0
je 0x1400c60b9
xor byte [rsp + 0x30], 0xa9
mov byte [rsp + 0x32], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x138]
call fcn.14005dd70
nop
lea r8, [rsp + 0x118]
cmp qword [rsp + 0x130], 0xf
cmova r8, qword [rsp + 0x118]
mov r9, qword [rsp + 0x128]
lea rcx, [rsp + 0x138]
call fcn.140071a80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x168], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x138]
call fcn.14005d600
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x158]
lea rcx, [rsp + 0xf0]
call fcn.14005da60
mov edi, 0x7e00
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 0xf
jbe 0x1400c6199
inc rdx
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6194
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c6194
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14026477c
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x1d8], xmm0
movups xmm1, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x1e8], xmm1
movdqa xmm0, xmmword [0x140302720]
movdqu xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0xf0], 0
lea rcx, [rsp + 0xf0]
call fcn.14005d600
nop
lea rcx, [rsp + 0x158]
call fcn.14005d600
nop
lea rcx, [rsp + 0x118]
call fcn.14005d600
nop
lea rcx, [rsp + 0x40]
call fcn.14005d600
mov rdx, qword [0x14033d460]
cmp qword [rdx + 0x98], 0
je 0x1400c6422
mov rdx, qword [rdx + 0xa0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400c6240
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
mov word [rsp + 0x30], __WSAFDIsSet
mov byte [rsp + 0x32], 1
mov rax, qword [0x14033d460]
mov rdx, qword [rax + 0x98]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400c6286
lea rcx, [rsp + 0x40]
call fcn.140070cc0
nop
mov word [rsp + 0x110], Ordinal_60
mov byte [rsp + 0x112], 0
lea rax, [rsp + 0x110]
mov r9, rsi
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400c62c0
lea r8, [rsp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.140071a80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x128], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
cmp byte [rsp + 0x32], 0
je 0x1400c6313
xor byte [rsp + 0x30], 0xa9
mov byte [rsp + 0x32], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14005dd70
nop
lea r8, [rsp + 0x118]
cmp qword [rsp + 0x130], 0xf
cmova r8, qword [rsp + 0x118]
mov r9, qword [rsp + 0x128]
lea rcx, [rsp + 0x60]
call fcn.140071a80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x168], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.14005d600
nop
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x158]
lea rcx, [rsp + 0xf0]
call fcn.14005da60
mov edi, 0x8787e00
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova rdx, qword [rsp + 0xf0]
mov r8, qword [rsp + 0x100]
lea rcx, [rsp + 0x1d8]
call fcn.14005d660
nop
lea rcx, [rsp + 0xf0]
call fcn.14005d600
nop
lea rcx, [rsp + 0x158]
call fcn.14005d600
nop
lea rcx, [rsp + 0x118]
call fcn.14005d600
nop
lea rcx, [rsp + 0x40]
call fcn.14005d600
nop
lea rcx, [rsp + 0x138]
call fcn.14005d600
jmp 0x1400c6422
mov rsi, 0xffffffffffffffff
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0xc8]
call fcn.14005d4d0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x130], r13
mov r8d, gethostname
lea rdx, str.https:__www.growtopia1.com_growtopia_server_data.php
lea rcx, [rsp + 0x118]
call fcn.140070cc0
nop
mov r8, rbx
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x198]
call fcn.1400742b0
nop
lea rcx, [rsp + 0x198]
mov r14, qword [rsp + 0x198]
mov r15, qword [rsp + 0x1b0]
cmp r15, 0xf
cmova rcx, r14
mov qword [rsp + 0x20], 5
lea r9, str.meta
xor r8d, r8d
mov rbx, qword [rsp + 0x1a8]
mov rdx, rbx
call fcn.140070930
cmp rax, 0xffffffffffffffff
je 0x1400c674d
lea r12, [rsp + 0x198]
cmp r15, 0xf
cmova r12, r14
add r12, rbx
lea rax, [rsp + 0x198]
cmp r15, 0xf
cmova rax, r14
add rbx, rax
lea rcx, [rsp + 0x198]
cmp r15, 0xf
cmova rcx, r14
mov r8b, reloc.WS2_32.dll_listen
mov rdx, rbx
call fcn.1402645c0
mov r8, rax
cmp rax, rbx
je 0x1400c654d
inc rax
cmp rax, rbx
je 0x1400c654d
movzx ecx, byte [rax]
cmp cl, 0xd
je 0x1400c6545
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x1400c6537
lea rax, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 0xf
cmova rax, qword [rsp + 0x198]
mov r9, r8
sub r9, rax
sub r12, r8
mov rbx, qword [rsp + 0x1a8]
mov rax, rbx
sub rax, r9
cmp rax, r12
cmovb r12, rax
lea rcx, [rsp + 0x198]
cmp qword [rsp + 0x1b0], 0xf
cmova rcx, qword [rsp + 0x198]
add rcx, r9
sub rbx, r12
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + r12]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x1a8], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rax
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.14005d4d0
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.14005f640
nop
mov dword [rsp + 0x30], 0xd8d9c5d9
mov word [rsp + 0x34], 0x100
mov rcx, r13
nop dword [rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400c6610
mov byte [rsp + 0x35], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.14005dd70
or edi, 0x18000
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xf0]
call fcn.14005f980
test rax, rax
je 0x1400c66f7
mov dword [rsp + 0xe8], 0xd8d9c5d9
mov word [rsp + 0xec], 0x100
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0xe8], al
inc rcx
cmp rcx, 4
jb 0x1400c6680
mov byte [rsp + 0xed], 0
lea r8, [rsp + 0xec]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.14005dd70
or edi, 0x6000000
or edi, 1
mov dword [rsp + 0x110], edi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xf0]
call fcn.14005f980
add rax, 0x38
cmp qword [rax + 0x18], 0xf
jbe 0x1400c66e5
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [0x14033d460]
jmp 0x1400c6704
mov rcx, qword [0x14033d460]
mov eax, dword [rcx + 0xf0]
mov dword [rcx + 0xf0], eax
test dil, 1
je 0x1400c671e
and edi, 0xfffffffe
lea rcx, [rsp + 0x60]
call fcn.14005d600
nop
lea rcx, [rsp + 0x158]
call fcn.14005d600
mov rcx, qword [0x14033d460]
mov eax, dword [rcx + 0xf0]
mov dword [rcx + 0xf4], eax
lea rcx, [rsp + 0xf0]
call fcn.14006e110
jmp 0x1400c67bf
lea rdx, str.gt1_block_detected_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, 8
lea rdx, str.gt1block
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
lea rdx, [rsp + 0x138]
call fcn.14006db80
mov byte [rax], 1
lea rcx, [rsp + 0x138]
call fcn.14005d600
lea rax, [rsp + 0x80]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x80]
call fcn.14005d4d0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8d, gethostname
lea rdx, str.https:__www.growtopia2.com_growtopia_server_data.php
lea rcx, [rsp + 0x40]
call fcn.140070cc0
nop
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1b8]
call fcn.1400742b0
nop
lea rcx, [rsp + 0x1b8]
mov r14, qword [rsp + 0x1b8]
mov r15, qword [rsp + 0x1d0]
cmp r15, 0xf
cmova rcx, r14
mov qword [rsp + 0x20], 5
lea r9, str.meta
xor r8d, r8d
mov rbx, qword [rsp + 0x1c8]
mov rdx, rbx
call fcn.140070930
cmp rax, 0xffffffffffffffff
je 0x1400c6ad1
lea r12, [rsp + 0x1b8]
cmp r15, 0xf
cmova r12, r14
add r12, rbx
lea rax, [rsp + 0x1b8]
cmp r15, 0xf
cmova rax, r14
add rbx, rax
lea rcx, [rsp + 0x1b8]
cmp r15, 0xf
cmova rcx, r14
mov r8b, reloc.WS2_32.dll_listen
mov rdx, rbx
call fcn.1402645c0
mov r8, rax
cmp rax, rbx
je 0x1400c68db
inc rax
cmp rax, rbx
je 0x1400c68db
movzx ecx, byte [rax]
cmp cl, 0xd
je 0x1400c68d3
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x1400c68c5
lea rax, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0xf
cmova rax, qword [rsp + 0x1b8]
mov r9, r8
sub r9, rax
sub r12, r8
mov rbx, qword [rsp + 0x1c8]
mov rax, rbx
sub rax, r9
cmp rax, r12
cmovb r12, rax
lea rcx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0xf
cmova rcx, qword [rsp + 0x1b8]
add rcx, r9
sub rbx, r12
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + r12]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x1c8], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rax
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0xc8]
call fcn.14005d4d0
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.14005f640
nop
mov dword [rsp + 0xe8], 0xd8d9c5d9
mov word [rsp + 0xec], 0x100
mov rcx, r13
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0xe8], al
inc rcx
cmp rcx, 4
jb 0x1400c69a0
mov byte [rsp + 0xed], 0
lea r8, [rsp + 0xec]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x158]
call fcn.14005dd70
or edi, 0x60000
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xf0]
call fcn.14005f980
test rax, rax
je 0x1400c6a7b
mov dword [rsp + 0x30], 0xd8d9c5d9
mov word [rsp + 0x34], 0x100
mov rcx, r13
nop
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400c6a10
mov byte [rsp + 0x35], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14005dd70
or edi, 0x1800000
or edi, 2
mov dword [rsp + 0x110], edi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xf0]
call fcn.14005f980
add rax, 0x38
cmp qword [rax + 0x18], 0xf
jbe 0x1400c6a69
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [0x14033d460]
jmp 0x1400c6a88
mov rcx, qword [0x14033d460]
mov eax, dword [rcx + 0xf0]
mov dword [rcx + 0xf0], eax
test dil, 2
je 0x1400c6aa2
and edi, 0xfffffffd
lea rcx, [rsp + 0x60]
call fcn.14005d600
nop
lea rcx, [rsp + 0x158]
call fcn.14005d600
mov rcx, qword [0x14033d460]
mov eax, dword [rcx + 0xf0]
mov dword [rcx + 0xf4], eax
lea rcx, [rsp + 0xf0]
call fcn.14006e110
jmp 0x1400c6b43
lea rdx, str.gt2_block_detected_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, 8
lea rdx, str.gt2block
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
lea rdx, [rsp + 0x138]
call fcn.14006db80
mov byte [rax], 1
lea rcx, [rsp + 0x138]
call fcn.14005d600
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x128], xmm1
mov r8d, 8
lea rdx, str.gt1block
lea rcx, [rsp + 0x118]
call fcn.140070cc0
nop
or edi, 4
mov dword [rsp + 0x110], edi
lea rdx, [rsp + 0x118]
call fcn.14006db80
cmp byte [rax], 0
je 0x1400c6be3
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, 8
lea rdx, str.gt2block
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
or edi, 8
mov dword [rsp + 0x110], edi
lea rdx, [rsp + 0x138]
call fcn.14006db80
cmp byte [rax], 0
je 0x1400c6be3
mov bl, 1
jmp 0x1400c6be5
xor bl, bl
test dil, 8
je 0x1400c6bfc
and edi, 0xfffffff7
lea rcx, [rsp + 0x138]
call fcn.14005d600
nop
test dil, 4
je 0x1400c6c0f
lea rcx, [rsp + 0x118]
call fcn.14005d600
test bl, bl
je 0x1400c6c88
movdqa xmm0, xmmword [0x140303120]
movdqu xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0x100], 0x9bd5dbda
mov dword [rsp + 0x104], 0xafd39ec9
mov dword [rsp + 0x108], 0xe5adaba6
mov word [rsp + 0x10c], Ordinal_211
mov byte [rsp + 0x10e], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0xf0], al
inc rcx
cmp rcx, 0x1d
jb 0x1400c6c60
mov byte [rsp + 0x10e], 0
lea rcx, [rsp + 0xf0]
call fcn.14005deb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f8], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x158], xmm1
movdqu xmmword [rsp + 0x168], xmm0
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.http:__38.107.215.46:90
lea rcx, [rsp + 0x158]
call fcn.140070cc0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140302720]
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x40], 0
movups xmmword [rsp + 0x138], xmm0
movdqu xmmword [rsp + 0x148], xmm1
mov byte [rsp + 0x138], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x1f8]
call fcn.1400c1470
nop
lea rcx, [rsp + 0x138]
call fcn.14005d600
nop
lea rcx, [rsp + 0x40]
call fcn.14005d600
nop
lea rcx, [rsp + 0x158]
call fcn.14005d600
mov rax, qword [rsp + 0x1f8]
mov byte [rax + 0x240], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, Ordinal_41
lea rdx, str._database_passdf84Det12378dwbnhthfda923
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
mov rbx, qword [rsp + 0x1f8]
lea rax, [rsp + 0x80]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xb8], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
mov ecx, 0x60
call fcn.140264740
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x118]
mov rcx, rbx
call fcn.1400bf8e0
nop
mov r8, qword [rsp + 0xf0]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xf0]
call fcn.140075390
mov edx, 0x60
mov rcx, qword [rsp + 0xf0]
call fcn.14026477c
nop
lea rcx, [rsp + 0x138]
call fcn.14005d600
mov rdx, qword [rsp + 0x118]
test rdx, rdx
je 0x1400c76af
add rdx, 0x58
cmp qword [rdx + 0x18], 0xf
jbe 0x1400c6e79
mov rdi, qword [rdx]
mov r14, rdi
mov rbx, rdi
add r14, qword [rdx + 0x10]
jmp 0x1400c6e86
mov r14, qword [rdx + 0x10]
add r14, rdx
mov rbx, rdx
mov rdi, rdx
cmp rbx, r14
je 0x1400c6ea4
sub rdi, rbx
nop
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r14
jne 0x1400c6e90
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, 1
lea rdx, [0x1402fb104]
lea rcx, [rsp + 0x138]
call fcn.140070cc0
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0x58
lea r8, [rsp + 0x138]
lea rcx, [rsp + 0xf0]
call fcn.140074100
mov rdi, rax
lea rax, [0x14033d3b0]
cmp rax, rdi
je 0x1400c6fb2
mov rbx, qword [0x14033d3b0]
test rbx, rbx
je 0x1400c6f87
mov r14, qword [0x14033d3b8]
cmp rbx, r14
je 0x1400c6f3a
mov rcx, rbx
call fcn.14005d600
add rbx, 0x20
cmp rbx, r14
jne 0x1400c6f22
mov rbx, qword [0x14033d3b0]
mov rdx, qword [0x14033d3c0]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x1400c6f6d
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400c7361
mov rbx, rcx
mov rcx, rbx
call fcn.14026477c
mov qword [0x14033d3b0], r13
xorps xmm0, xmm0
movdqu xmmword [0x14033d3b8], xmm0
mov rax, qword [rdi]
mov qword [0x14033d3b0], rax
mov rax, qword [rdi + 8]
mov qword [0x14033d3b8], rax
mov rax, qword [rdi + 0x10]
mov qword [0x14033d3c0], rax
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
lea rcx, [rsp + 0xf0]
call fcn.14006f2d0
nop
lea rcx, [rsp + 0x138]
call fcn.14005d600
lea rdx, str.Collected_Players:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
mov rdx, qword [0x14033d3b8]
sub rdx, qword [0x14033d3b0]
sar rdx, 5
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r8, qword [rsp + 0x128]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x128]
call fcn.140075390
mov edx, 0x60
mov rcx, qword [rsp + 0x128]
call fcn.14026477c
mov rbx, qword [rsp + 0x118]
test rbx, rbx
je 0x1400c7061
mov rcx, rbx
call fcn.1400aace0
mov edx, 0x128
mov rcx, rbx
call fcn.14026477c
lea rcx, str.color_a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0xf0], 0xede8e5e5
mov dword [rsp + 0xf4], 0xe0ffefe1
mov dword [rsp + 0xf8], 0xf5e7f3f5
mov word [rsp + 0xfc], 0x100
mov rcx, r13
nop dword [rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0xf0], al
inc rcx
cmp rcx, 0xc
jb 0x1400c70a0
mov byte [rsp + 0xfd], 0
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
movdqa xmm0, xmmword [0x140303680]
movdqu xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0x100], 0xd9cfd3e5
mov dword [rsp + 0x104], 0xa491cdd0
mov dword [rsp + 0x108], 0x100b6a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x128], xmm1
mov rdx, qword [rsp + 0xe8]
nop word [rax + rax]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x1400c7130
mov r8, rsi
lea rcx, [rsp + 0x118]
call fcn.140070cc0
nop
cmp byte [rsp + 0x10b], 0
je 0x1400c717b
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0xf0], al
inc rcx
cmp rcx, 0x1a
jb 0x1400c7160
mov byte [rsp + 0x10b], 0
lea r8, [rsp + 0x10a]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x60]
call fcn.14005dd70
nop
lea r8, [rsp + 0x118]
cmp qword [rsp + 0x130], 0xf
cmova r8, qword [rsp + 0x118]
mov r9, qword [rsp + 0x128]
lea rcx, [rsp + 0x60]
call fcn.140071a80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x138], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x148], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.14005d600
nop
lea rcx, [rsp + 0x118]
call fcn.14005d600
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8d, 9
lea rdx, str.items.dat
lea rcx, [rsp + 0x40]
call fcn.140070cc0
lea rdx, [rsp + 0x40]
lea rcx, [0x14033d900]
call fcn.1400c1bf0
nop
lea rcx, [rsp + 0x138]
call fcn.14005d600
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x490]
call sub.VCRUNTIME140.dll_memset
mov r8d, 1
lea rdx, str.server.txt
lea rcx, [rsp + 0x490]
call fcn.1400c8b00
nop
cmp qword [rsp + 0x520], 0
je 0x1400c7368
lea rcx, [rsp + 0x118]
call fcn.14006ef00
nop
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x490]
call fcn.1400cdea0
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x118]
call fcn.14006eb30
mov rbx, qword [rax]
mov byte [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x118]
call fcn.14006eb30
mov r8, qword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x118]
call fcn.14006eb50
lea r9, [rsp + 0x38]
mov rdx, qword [rax]
lea rcx, [rsp + 0xc0]
call fcn.1400cdd70
mov r9, rbx
mov r8, qword [rax]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x118]
call fcn.1400c95d0
lea rcx, [rsp + 0x118]
call fcn.14005da50
cmp rax, 5
jbe 0x1400c7349
lea rdx, [rsp + 0x118]
lea rcx, [0x140330630]
call fcn.14006ec90
lea rcx, [rsp + 0x490]
call fcn.1400c8ac0
nop
lea rcx, [rsp + 0x118]
jmp 0x1400c73d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rsp + 0x158]
call fcn.1400c5ac0
nop
cmp qword [rsp + 0x168], 0
jne 0x1400c73b8
lea rdx, str.couldnt_find_server.txt
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x158]
lea rcx, [0x140330630]
call fcn.14006ec90
nop
lea rcx, [rsp + 0x158]
call fcn.14005d490
lea rdx, str.Running_server:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
mov rcx, rax
lea rdx, [0x140330630]
call fcn.14006fb10
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._______HOSTS_______
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140330630]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fb10
mov rcx, rax
lea rdx, str._growtopia1.com
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140330630]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fb10
mov rcx, rax
lea rdx, str._growtopia2.com
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140330630]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fb10
mov rcx, rax
lea rdx, str._www.growtopia1.com
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140330630]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fb10
mov rcx, rax
lea rdx, str._www.growtopia2.com
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._______HOSTS_______
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006f940
lea rdx, [0x14006fc30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400c2fc0]
lea rcx, [rsp + 0x208]
call fcn.1400cdf60
nop
lea rcx, [rsp + 0x208]
call fcn.14005e190
lea rdx, [0x1400c2e00]
lea rcx, [rsp + 0x218]
call fcn.1400cdf60
nop
lea rcx, [rsp + 0x218]
call fcn.14005e190
call fcn.1400aa7b0
call fcn.1400e4b40
test al, al
je 0x1400c75aa
movdqa xmm0, xmmword [0x140303110]
movdqu xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0x100], 0xc4d4c8e9
mov dword [rsp + 0x104], 0xb590c4
mov byte [rsp + 0x108], 1
lea rcx, [rsp + 0xf0]
call fcn.14006b910
jmp 0x1400c75eb
movdqa xmm0, xmmword [0x140303170]
movdqu xmmword [rsp + 0x80], xmm0
movdqa xmm1, xmmword [0x1403036f0]
movdqu xmmword [rsp + 0x90], xmm1
mov word [rsp + 0xa0], Ordinal_200
mov byte [rsp + 0xa2], 1
lea rcx, [rsp + 0x80]
call fcn.1400c7730
mov rcx, rax
call fcn.14005deb0
lea rdx, [0x1400c59d0]
lea rcx, [rsp + 0x228]
call fcn.1400cdf60
nop
lea rcx, [rsp + 0x228]
call fcn.14005e190
lea rdx, [0x1400c5390]
lea rcx, [rsp + 0x238]
call fcn.1400cdf60
nop
lea rcx, [rsp + 0x238]
call fcn.14005e190
lea rdx, [0x1400c5940]
lea rcx, [rsp + 0x248]
call fcn.1400cdf60
nop
lea rcx, [rsp + 0x248]
call fcn.1400aa620
lea rcx, [rsp + 0x380]
call fcn.1400c5380
lea rcx, [rsp + 0x380]
call fcn.1400c7810
nop
lea rcx, [rsp + 0x380]
call fcn.1400c77a0
test al, al
je 0x1400c76a6
lea rdx, [0x1402fb157]
lea rcx, [rsp + 0x380]
call fcn.14006f940
lea rcx, [rsp + 0x380]
call fcn.1400c7760
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movdqa xmm0, xmmword [0x140303090]
movdqu xmmword [rsp + 0x80], xmm0
movdqa xmm1, xmmword [0x1403036a0]
movdqu xmmword [rsp + 0x90], xmm1
mov dword [rsp + 0xa0], 0xc8e0b0cf
mov word [rsp + 0xa4], 0x100
lea rcx, [rsp + 0x80]
call fcn.140074cf0
mov rcx, rax
call fcn.14005deb0
mov dword [rsp + 0x110], 5
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xf0]
call fcn.1400cdee0
mov rcx, rax
call fcn.1400cdef0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3