Function at 0x140002e60
Capabilities:
Create process on windows
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
mov rax, qword [0x140064040]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov dword [rsp + 0x40], 0
cmp byte [0x1400640c0], 1
jne 0x140003f0b
mov rax, qword [0x140095d80]
movdqa xmm0, xmmword [0x14005a280]
movups xmmword [rax + 0x39f0], xmm0
movups xmmword [rax + 0x3a00], xmm0
movups xmmword [rax + 0x3b20], xmm0
movdqa xmm2, xmmword [0x14005a330]
movups xmmword [rax + 0x3b30], xmm2
movdqa xmm0, xmmword [0x14005a2f0]
movups xmmword [rax + 0x3b40], xmm0
movdqa xmm1, xmmword [0x14005a2b0]
movups xmmword [rax + 0x3b50], xmm1
movups xmmword [rax + 0x3b60], xmm2
movdqa xmm0, xmmword [0x14005a310]
movups xmmword [rax + 0x3b70], xmm0
movdqa xmm2, xmmword [0x14005a370]
movups xmmword [rax + 0x3b00], xmm2
movdqa xmm0, xmmword [0x14005a340]
movups xmmword [rax + 0x3b10], xmm0
movdqa xmm1, xmmword [0x14005a450]
movups xmmword [rax + 0x39d0], xmm1
movups xmmword [rax + 0x3af0], xmm2
mov dword [rax + 0x3918], 0x40a00000
mov dword [rax + 0x394c], 0x40400000
mov dword [rax + 0x3988], 0x40400000
mov dword [rax + 0x3934], 0x40a00000
mov dword [rax + 0x3980], 0x40400000
mov dword [rax + 0x4114], 0x437a0000
mov dword [rax + 0x4118], 0x43480000
mov dword [rax + 0x40f8], 1
or dword [rax + 0x40f0], 0x42
mov dword [rax + 0x4150], 0x3f800000
mov byte [rsp + 0x70], 0x36
mov al, 0x52
mov cl, 7
mov dl, 0x46
mov r8b, 0x4f
movzx r9d, r8b
movzx r10d, r8b
mov r11b, 0x16
mov bl, 0x55
mov dil, 0x5a
mov sil, 0x5f
mov r14b, 0x53
mov r15b, 0x58
mov r12b, 0x42
xor r13d, r13d
xor al, 0x36
mov byte [rsp + 0x71], al
xor cl, 0x36
mov byte [rsp + 0x72], cl
xor dl, 0x36
mov byte [rsp + 0x73], dl
xor r8b, 0x36
mov byte [rsp + 0x74], r8b
xor r9b, 0x36
mov byte [rsp + 0x75], r9b
xor r10b, 0x36
mov byte [rsp + 0x76], r10b
xor r11b, 0x36
mov byte [rsp + 0x77], r11b
xor bl, 0x36
mov byte [rsp + 0x78], bl
xor dil, 0x36
mov byte [rsp + 0x79], dil
xor sil, 0x36
mov byte [rsp + 0x7a], sil
xor r14b, 0x36
mov byte [rsp + 0x7b], r14b
xor r15b, 0x36
mov byte [rsp + 0x7c], r15b
xor r12b, 0x36
mov byte [rsp + 0x7d], r12b
mov byte [rsp + 0x7e], r13b
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x20]
call fcn.1400046f0
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
mov r8d, 0x13b
lea rdx, [0x1400640c0]
call fcn.1400145c0
mov byte [rsp + 0x70], 0x27
mov al, 0x6f
mov cl, 0x63
mov dl, 0xa
mov r8b, 0x77
mov r9b, 0x4b
mov r10b, 0x46
mov r11b, 0x5e
mov bl, 0x42
mov dil, 0x55
mov sil, 9
movzx r14d, bl
mov r15b, 0x5f
movzx r12d, bl
xor al, 0x27
mov byte [rsp + 0x71], al
xor cl, 0x27
mov byte [rsp + 0x72], cl
xor dl, 0x27
mov byte [rsp + 0x73], dl
xor r8b, 0x27
mov byte [rsp + 0x74], r8b
xor r9b, 0x27
mov byte [rsp + 0x75], r9b
xor r10b, 0x27
mov byte [rsp + 0x76], r10b
xor r11b, 0x27
mov byte [rsp + 0x77], r11b
xor bl, 0x27
mov byte [rsp + 0x78], bl
xor dil, 0x27
mov byte [rsp + 0x79], dil
xor sil, 0x27
mov byte [rsp + 0x7a], sil
xor r14b, 0x27
mov byte [rsp + 0x7b], r14b
xor r15b, 0x27
mov byte [rsp + 0x7c], r15b
xor r12b, 0x27
mov byte [rsp + 0x7d], r12b
mov byte [rsp + 0x7e], r13b
lea rcx, [rsp + 0x71]
call fcn.140005f40
mov dword [0x140095efc], eax
test eax, eax
setne byte [0x140095ef8]
test eax, eax
je 0x140003eb1
mov rcx, qword [0x140095d80]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
xorps xmm8, xmm8
addss xmm0, xmm8
addss xmm2, xmm8
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43c80000
mov dword [rsp + 0x44], 0x43c80000
lea rdx, [rsp + 0x40]
call fcn.140011410
mov rcx, qword [0x140095d80]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
mov rsi, qword [rax + 0x2c0]
movss xmm10, dword [rax + 0x48]
movss xmm6, dword [rax + 0x4c]
movss xmm11, dword [rax + 0x50]
movss xmm13, dword [rax + 0x54]
mov rdi, qword [0x140095e70]
mov rcx, rdi
mov rbx, qword [0x140095e68]
sub rcx, rbx
movabs r15, 0x6666666666666667
mov rax, r15
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movss xmm9, dword [0x140059fa0]
cmp rdx, 0x19
jae 0x140003386
cvttss2si r14d, xmm11
movss xmm12, dword [0x14005a028]
movss xmm7, dword [0x140059fd4]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv r14d
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm10
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x74], xmm6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
addss xmm0, xmm12
movss dword [rsp + 0x78], xmm0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000003
jge 0x1400032fa
dec eax
or eax, 0xfffffffc
inc eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm7
addss xmm0, xmm9
movss dword [rsp + 0x7c], xmm0
mov dword [rbp - 0x80], 0xc8ffffff
mov rdx, qword [0x140095e70]
cmp rdx, qword [0x140095e78]
je 0x14000334a
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], 0xc8ffffff
mov rdi, qword [0x140095e70]
add rdi, 0x14
mov qword [0x140095e70], rdi
jmp 0x14000335b
lea r8, [rsp + 0x70]
call fcn.1400059b0
mov rdi, qword [0x140095e70]
mov rcx, rdi
mov rbx, qword [0x140095e68]
sub rcx, rbx
mov rax, r15
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x19
jb 0x140003290
cmp rbx, rdi
je 0x140003468
movaps xmm7, xmm6
addss xmm7, xmm13
nop word [rax + rax]
movss xmm0, dword [rbx + 8]
mov rax, qword [0x140095d80]
mulss xmm0, dword [rax + 0x18]
addss xmm0, dword [rbx + 4]
movss dword [rbx + 4], xmm0
comiss xmm0, xmm7
jbe 0x1400033eb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cvttss2si ecx, xmm11
cdq
idiv ecx
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm10
movss dword [rbx], xmm0
movaps xmm1, xmm6
subss xmm1, dword [rbx + 0xc]
movss dword [rbx + 4], xmm1
add rbx, 0x14
cmp rbx, rdi
jne 0x1400033a0
mov rdi, qword [0x140095e70]
mov rbx, qword [0x140095e68]
cmp rbx, rdi
je 0x140003468
xor r15d, r15d
nop word [rax + rax]
mov r14d, dword [rbx + 0x10]
movss xmm2, dword [rbx + 0xc]
test r14d, 0xff000000
je 0x14000345f
comiss xmm8, xmm2
jae 0x14000345f
mov dword [rsp + 0x20], 0x30
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
call fcn.1400368b0
mov r8d, dword [rsi + 0x78]
dec r8d
mov dword [rsi + 0x78], r8d
mov r9d, r14d
mov rdx, qword [rsi + 0x80]
mov rcx, rsi
call fcn.140036300
mov dword [rsi + 0x78], r15d
add rbx, 0x14
cmp rbx, rdi
jne 0x140003410
lea rcx, [rbp - 0x70]
call fcn.1400011b0
xorps xmm10, xmm10
cvtsi2ss xmm10, qword [rax]
divss xmm10, dword [0x14005a058]
mov rcx, qword [0x140095d80]
mov rcx, qword [rcx + 0x3d48]
call fcn.140017970
mov rbx, qword [0x140095d80]
mov rax, qword [rbx + 0x3d48]
movss xmm0, dword [0x14005a004]
divss xmm0, dword [rax + 0x14]
movss dword [rax + 0x5c], xmm0
mov esi, r13d
mov rdi, r13
mulss xmm10, dword [0x140059fe0]
lea r14, [0x140000000]
movss xmm12, dword [0x140059f44]
movss xmm11, dword [0x140059f5c]
nop
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm12
addss xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
addss xmm0, xmm9
mulss xmm0, xmm11
movaps xmm7, xmm0
mulss xmm7, xmm8
addss xmm7, xmm9
mulss xmm0, xmm11
movaps xmm6, xmm9
subss xmm6, xmm0
mov dword [rsp + 0x70], r13d
movups xmm0, xmmword [rbx + 0x39d0]
movups xmmword [rsp + 0x74], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rsp + 0x70]
call fcn.14002bdc0
movaps xmm0, xmm6
shufps xmm0, xmm0, 0xe1
movss xmm0, xmm6
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm6
shufps xmm0, xmm0, 0x27
movss xmm0, xmm7
shufps xmm0, xmm0, 0x39
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbx + 0x39d0], xmm0
movsx edx, byte [rdi + r14 + 0x549f0]
lea rcx, [0x1400549c8]
call fcn.1400430e0
cmp esi, 0x19
jge 0x14000358e
movaps xmm1, xmm8
movaps xmm0, xmm8
call fcn.140018a90
mov rbx, qword [0x140095d80]
movsxd rax, dword [rbx + 0x4180]
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x4188]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, 0x39d
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8], xmm0
dec dword [rbx + 0x4180]
inc esi
inc rdi
cmp rdi, 0x1a
jl 0x1400034e0
call fcn.140017a10
mov rbx, qword [0x140095d80]
mov rax, qword [rbx + 0x3fe0]
cmp byte [rax + 0xd0], r13b
jne 0x140003608
mov eax, dword [rax + 0x1d4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400450e0
mov rbx, qword [0x140095d80]
mov dword [rsp + 0x40], 0x42f00000
mov dword [rsp + 0x44], 0x42480000
movdqa xmm6, xmmword [0x14005a350]
mov dword [rsp + 0x70], 0x15
movups xmm0, xmmword [rbx + 0x3b20]
movups xmmword [rsp + 0x74], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rsp + 0x70]
call fcn.14002bdc0
movups xmmword [rbx + 0x3b20], xmm6
movdqa xmm6, xmmword [0x14005a3a0]
mov rbx, qword [0x140095d80]
mov eax, 0x16
mov dword [rsp + 0x70], eax
movups xmm0, xmmword [rbx + 0x3b30]
movups xmmword [rsp + 0x74], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rsp + 0x70]
call fcn.14002bdc0
movups xmmword [rbx + 0x3b30], xmm6
movdqa xmm6, xmmword [0x14005a310]
mov rbx, qword [0x140095d80]
mov dword [rsp + 0x70], 0x17
movups xmm0, xmmword [rbx + 0x3b40]
movups xmmword [rsp + 0x74], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rsp + 0x70]
call fcn.14002bdc0
movups xmmword [rbx + 0x3b40], xmm6
mov rcx, qword [0x140095d80]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm0, dword [0x14005a02c]
movss xmm6, dword [0x14005a01c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rdx, [rsp + 0x40]
lea rcx, str.d1pyyy_client
call fcn.140043950
test al, al
je 0x14000377b
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__t.me_d1pyyyclient
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [0x140095d80]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm0, dword [0x14005a014]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rdx, [rsp + 0x40]
lea rcx, str.BYPASS
call fcn.140043950
test al, al
je 0x14000381f
cmp byte [0x140095d51], r13b
je 0x14000381a
call fcn.140006780
jmp 0x14000381f
call fcn.140006780
mov r8, qword [0x140095d80]
movsxd rax, dword [r8 + 0x4180]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x4188]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, 0x39d
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8], xmm0
movsxd rcx, dword [r8 + 0x4180]
lea eax, [rcx - 1]
mov dword [r8 + 0x4180], eax
lea rax, [rcx - 2]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x4188]
movsxd rax, dword [rcx + rdx*4]
add rax, 0x39d
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 + 4]
movups xmmword [r8 + rax*8], xmm0
movsxd rcx, dword [r8 + 0x4180]
lea eax, [rcx - 1]
mov dword [r8 + 0x4180], eax
lea rax, [rcx - 2]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x4188]
movsxd rax, dword [rcx + rdx*4]
add rax, 0x39d
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 + 4]
movups xmmword [r8 + rax*8], xmm0
dec dword [r8 + 0x4180]
call fcn.1400114b0
movss xmm6, dword [0x14005a06c]
movaps xmm1, xmm6
movaps xmm0, xmm8
call fcn.140018a90
call fcn.14004d1e0
mov rbx, 0xffffffffffffffff
cmp byte [0x140095d50], r13b
je 0x140003d20
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov esi, 0xd
mov qword [rbp - 0x50], rsi
mov edi, 0xf
mov qword [rbp - 0x48], rdi
movsd xmm0, qword [str.d1pyyy_client]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x1400549d8]
mov dword [rbp - 0x58], eax
movzx eax, byte [0x1400549dc]
mov byte [rbp - 0x54], al
mov byte [rbp - 0x53], r13b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rax, [r14 + 0x58ef0]
mov qword [rbp], rax
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 8], rax
mov qword [rbp + 0x70], r13
mov dword [rbp + 0x78], 4
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x70], rax
lea rax, str._H:_M:_S
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
nop word [rax + rax]
inc rax
cmp byte [rax], 0
jne 0x140003a00
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call fcn.1400050c0
xor edx, edx
mov r8d, 0x8202b
lea rcx, str.watermark
call fcn.1400145c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x40], 5
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov ecx, dword [rbp + 0x78]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140003a85
mov rax, qword [rbp + 0x48]
mov r8, qword [rax]
test r8, r8
je 0x140003a85
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x70]
cmovb r8, qword [rbp + 0x70]
sub r8, rdx
jmp 0x140003ab6
test cl, 4
jne 0x140003aac
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140003aac
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x58]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140003ab6
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140003ac6
lea rcx, [rsp + 0x48]
call fcn.140004c70
nop
movabs rcx, 0x7fffffffffffffff
lea r12, [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea r15, [rsi + 3]
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x140003b20
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140051270
test rax, rax
je 0x140003b53
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003b62
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140003b3b
mov rdi, r13
jmp 0x140003b62
cmp rcx, 0x1000
jb 0x140003b5a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003f63
jmp 0x140003b05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140051270
mov rdi, rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rsi
mov esi, 0xd
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140054a54]
mov word [rsi + rdi], ax
movzx eax, byte [0x140054a56]
mov byte [rsi + rdi + 2], al
mov byte [rdi + r15], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400056b0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140003bf0
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400514ec
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140003c30
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400514ec
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call fcn.1400430e0
call fcn.1400172c0
lea rdx, str.watermark
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c8a
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 5
mov r9d, 5
mov r8d, r9d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140003cc8
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003cc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400514ec
mov qword [rbp - 0x30], r13
mov edi, 0xf
mov qword [rbp - 0x28], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.140004570
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
cmp byte [0x140095d54], 1
jne 0x140003d30
mov byte [0x140095d54], 0
cmp dword [0x140095d74], 3
jne 0x140003ea6
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x21
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 9
lea rdi, [0x140095d68]
mov r8, rdi
lea rdx, [0x140054a58]
lea rcx, str.Replaceble
call fcn.140048730
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x21
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 9
lea rsi, [0x140095d58]
mov r8, rsi
lea rdx, [0x140054a78]
lea rcx, str.New
call fcn.140048730
mov dword [rsp + 0x40], 0x42960000
mov dword [rsp + 0x44], 0x41a00000
lea rdx, [rsp + 0x40]
lea rcx, str.Replace
call fcn.140043950
test al, al
je 0x140003e85
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140003e00
test rax, rax
je 0x140003e85
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140003e10
test rbx, rbx
je 0x140003e85
mov ecx, 8
call fcn.140051270
lea rcx, [0x140001e80]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140005ef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140003ef6
cmp dword [rbp - 0x68], 0
je 0x140003eea
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140003eea
cmp byte [0x140095d52], 0
je 0x140003ea6
movaps xmm1, xmm6
movaps xmm0, xmm8
call fcn.140018a90
lea rcx, str.loading...
call fcn.1400430e0
call fcn.1400114b0
call fcn.1400172c0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140003f0b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.1400514ec
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140051250
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001390
nop
int3