Function at 0x140056600
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Download url
Get file attributes
Receive data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xae0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140071040]
xor rax, rsp
mov qword [rbp + 0xa60], rax
mov rdi, rcx
xor r12d, r12d
call fcn.14004f070
movabs rax, 0x6bb20dd7c72ddb0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x4b7d7bd1def3fa26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xa361665b80b9f571
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xba16991d2bc5c812
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x808508b097f7c52f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rbx, 0xe230287101c9fa68
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs r15, 0x449d37a4b759af63
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
movabs rsi, 0x3e131aa5ad9c9544
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
movabs r14, 0xd04e082ee697991d
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
movabs r13, 0xca38ed6f5fb7a966
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movabs rax, 0x808508b097f7b547
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm0, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1a0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x1c0]
vxorps xmm1, xmm1, xmmword [rbp + 0x5a0]
vmovdqa xmmword [rbp + 0x1c0], xmm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], r12
lea rax, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1400567d0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x180]
call fcn.14005a480
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x260]
call fcn.14004e640
mov rdx, qword [rbp + 0x278]
cmp rdx, 0xf
jbe 0x140056843
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005683e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005683e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], r12b
movabs rax, 0x30ee58cbd5059520
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x5f7946c9c1e9fb25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xba12664784cbf86b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xa654894128d6df07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rcx, 0x808508b097f7b547
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm0, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1e0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x200]
vxorps xmm1, xmm1, xmmword [rbp + 0x5e0]
vmovdqa xmmword [rbp + 0x200], xmm1
lea rcx, [rbp + 0x1e0]
vzeroupper
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rdi]
mov rcx, qword [rcx]
call fcn.140011020
mov rcx, qword [0x1400a2400]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x140066aa4]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x140066ab4]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, str.Starting
call fcn.140039d50
call fcn.1400110c0
mov rax, qword [rdi + 8]
mov rbx, qword [rax]
movaps xmm0, xmmword [0x140066c40]
movups xmmword [rbp + 0x2a0], xmm0
lea rcx, [rbp + 0x2a0]
call fcn.1400032e0
mov rcx, qword [rdi + 0x10]
movss xmm2, dword [rcx + 4]
addss xmm2, dword [0x140066ab4]
movss xmm1, dword [rcx]
movaps xmm0, xmm1
addss xmm0, dword [0x140066a98]
addss xmm0, dword [0x140066ad8]
movss dword [rbp + 0x40], xmm0
movss dword [rbp + 0x44], xmm2
addss xmm1, dword [0x140066a94]
movss dword [rbp + 8], xmm1
movss dword [rbp + 0xc], xmm2
mov dword [rsp + 0x28], r12d
movss xmm0, dword [0x140066a20]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rbp + 0x40]
lea rdx, [rbp + 8]
mov rcx, rbx
call fcn.14002f010
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x29fc59cfd430c145
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x3e131aa5ad9ca821
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movdqa xmm0, xmmword [rbp + 0xe0]
xorps xmm0, xmmword [rbp + 0x570]
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
mov r8d, 0x31
lea rdx, str.https:__boostanull.fun_connect.php_actionget_ram
lea rcx, [rbp + 0x140]
call fcn.14005a480
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x140]
call fcn.140058ec0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1400a2410]
lea rcx, [rbp + 0x100]
call fcn.140058ec0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x378], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x388], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140056c0d
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056c08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140056c68
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056c63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056c63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
lea r14, [rbp + 0x378]
movq rcx, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova r14, rcx
movabs rbx, 0x7fffffffffffffff
movq rsi, xmm6
cmp rsi, rbx
ja 0x140057e69
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rsi, 0xf
ja 0x140056cf6
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x48], xmm0
jmp 0x140056d78
mov rdi, rsi
or rdi, 0xf
cmp rdi, rbx
jbe 0x140056d2b
mov rdi, rbx
add rax, 0x27
mov rcx, rax
call fcn.14005b968
mov rcx, rax
test rax, rax
je 0x140056e47
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140056d5d
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140056d4e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140057e5d
jmp 0x140056d09
test rcx, rcx
je 0x140056d5a
call fcn.14005b968
jmp 0x140056d5d
mov rax, r12
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x240]
call fcn.14004e640
mov rdi, rax
lea rax, [0x1400a1990]
cmp rax, rdi
je 0x140056e0f
mov rdx, qword [0x1400a19a8]
cmp rdx, 0xf
jbe 0x140056dd4
mov rcx, qword [0x1400a1990]
inc rdx
cmp rdx, 0x1000
jb 0x140056dcf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140056e47
mov rcx, r8
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [0x1400a19a0], xmm0
mov byte [0x1400a1990], 0
movups xmm0, xmmword [rdi]
movups xmmword [0x1400a1990], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x1400a19a0], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x140056e53
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
movabs rax, 0x29fc59cfd430c145
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x3e131aa5ad9ca821
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0x3e131aa5ad9c9544
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movdqa xmm0, xmmword [rbp + 0xf0]
xorps xmm0, xmmword [rbp + 0x560]
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x170], xmm1
mov r8d, 0x30
lea rdx, str.https:__boostanull.fun_connect.php_actionget_id
lea rcx, [rbp + 0x160]
call fcn.14005a480
nop
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x160]
call fcn.140058ec0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1400a2410]
lea rcx, [rbp + 0x120]
call fcn.140058ec0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x358], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x368], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140056fd1
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056fcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056fcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14005702c
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057027
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r12
lea r15, [rbp + 0x358]
movq rdi, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r15, rdi
movq rsi, xmm6
cmp rsi, rbx
ja 0x140057e57
cmp rsi, 0xf
ja 0x1400570a7
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], 0xf
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x68], xmm0
jmp 0x14005713c
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x1400570e3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14005b968
mov rcx, rax
test rax, rax
je 0x14005720b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14005711e
mov rbx, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005710f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140057e63
jmp 0x1400570c1
test rcx, rcx
je 0x14005711b
call fcn.14005b968
jmp 0x14005711e
mov rax, r12
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x220]
call fcn.14004e640
mov rbx, rax
lea rsi, [0x1400a18f8]
cmp rsi, rax
je 0x1400571d3
mov rdx, qword [0x1400a1910]
cmp rdx, 0xf
jbe 0x140057198
mov rcx, qword [0x1400a18f8]
inc rdx
cmp rdx, 0x1000
jb 0x140057193
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005720b
mov rcx, r8
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [0x1400a1908], xmm0
mov byte [0x1400a18f8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1400a18f8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400a1908], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x140057217
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057212
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x410]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x410]
call fcn.140058c00
nop
mov r8, rsi
lea rdx, [0x1400a243d]
lea rcx, [rbp + 0x280]
call fcn.140059a10
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140057274
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.14005b100
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x1400572c8
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400572c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400572c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
movdqa xmm0, xmmword [0x140066b80]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
lea rcx, [rbp + 0x418]
call fcn.140059490
test rax, rax
jne 0x140057312
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x410]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.C:_boostanulljava
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
movabs rcx, 0xbf216a0192f9fc6f
movabs rdx, 0xe554811a31d6dd15
movabs r15, 0x107d73cdddf0fa20
cmp eax, 0xffffffff
je 0x14005734d
shr eax, 4
test al, 1
jne 0x1400576c6
movabs rax, 0x30ee58cbd5059520
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x5f7946c9c1e9fb25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xd04e78479cb9f86b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rbx, 0x449d37a4b759af63
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
movabs rsi, 0x3e131aa5ad9c9544
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
movabs r8, 0xd04e082ee697991d
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x650], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x658], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x640]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x6bb20dd7c72ddb0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xf0ec729ef681d42d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rcx, 0xe230287101c9fa68
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
movabs rax, 0x808508b097f7b547
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
vmovdqu ymm0, ymmword [rbp + 0x600]
vpxor ymm0, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm0
vmovdqa xmm1, xmmword [rbp + 0xc0]
vxorps xmm1, xmm1, xmmword [rbp + 0x620]
vmovdqa xmmword [rbp + 0xc0], xmm1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x1400576b6
mov dword [rbp + 0x318], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
movups xmmword [rbp + 0x400], xmm0
lea rax, [rbp + 0x3a0]
test rax, rax
je 0x1400575b4
lea rdx, str.C:_boostanulljava.zip
lea rcx, [rbp + 0x3a0]
call fcn.14004c7d0
test eax, eax
je 0x1400575b4
lea r9, [rbp + 0x318]
lea rdx, str.C:_boostanull
lea rcx, [rbp + 0x3a0]
call fcn.14004d470
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_boostanulljava.zip
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x410], rax
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x418]
call fcn.140058b90
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x370]
cmp rdx, 0xf
jbe 0x14005766b
inc rdx
mov rcx, qword [rbp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057665
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
nop
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x140057a77
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057a72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057a72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r14, qword [rbp + 0x370]
mov rdi, qword [rbp + 0x358]
jmp 0x1400576da
movabs rbx, 0x449d37a4b759af63
movabs rsi, 0x3e131aa5ad9c9544
call fcn.14004f070
lea rcx, str.C:_boostanullclient_1_16_5
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400576fc
shr eax, 4
test al, 1
jne 0x140057a8c
xor edx, edx
lea rcx, str.C:_boostanullclient_1_16_5
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movabs rax, 0x30ee58cbd5059520
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
movabs rax, 0x525046c9c1e9fb25
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0xa027720092f9fc74
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
movabs rcx, 0xd04e082ee697991d
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm0, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm0
movabs rax, 0x6bb20dd7c72ddb0b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0xbf216a0192f9fc6f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
movabs rax, 0xe554811a31d6dd15
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xfaab7cdef29ed904
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe230287101c98a01
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x520], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x528], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x530], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x538], rax
movabs rax, 0x808508b097f7b547
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x540], rax
movabs rax, 0xe230287101c9fa68
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x548], rax
vmovdqu ymm0, ymmword [rbp + 0x520]
vpxor ymm0, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm0
vmovdqa xmm1, xmmword [rbp + 0xc0]
vxorps xmm1, xmm1, xmmword [rbp + 0x540]
vmovdqa xmmword [rbp + 0xc0], xmm1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x140057a7e
mov dword [rbp + 0x318], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
movups xmmword [rbp + 0x400], xmm0
lea rax, [rbp + 0x3a0]
test rax, rax
je 0x14005797c
lea rdx, str.C:_boostanullClient.zip
lea rcx, [rbp + 0x3a0]
call fcn.14004c7d0
test eax, eax
je 0x14005797c
lea r9, [rbp + 0x318]
lea rdx, str.C:_boostanullclient_1_16_5
lea rcx, [rbp + 0x3a0]
call fcn.14004d470
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:_boostanullClient.zip
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x410], rax
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x418]
call fcn.140058b90
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x370]
cmp rdx, 0xf
jbe 0x140057a33
inc rdx
mov rcx, qword [rbp + 0x358]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057a2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057a2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
nop
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x140057a77
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057a72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057a72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
mov al, 1
jmp 0x140057e1d
mov r14, qword [rbp + 0x370]
mov rdi, qword [rbp + 0x358]
call fcn.14004f070
mov ecx, 0x4e2
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x340], xmm1
mov qword [rbp + 0x350], r12
movups xmmword [rbp + 0x320], xmm0
movdqu xmmword [rbp + 0x330], xmm1
mov r8d, 0x28
lea rdx, str.https:__dolphin.rent_boostanull_jar1.jar
lea rcx, [rbp + 0x320]
call fcn.14005a480
nop
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 0xf
cmova rdx, qword [rbp + 0x320]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x310]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLOpenBlockingStreamA]
mov ebx, eax
test eax, eax
jne 0x140057b9e
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
lea r9, [rbp + 0x318]
mov r8d, 0x400
lea rdx, [rbp + 0x660]
call qword [rax + 0x18]
mov ebx, eax
mov eax, dword [rbp + 0x318]
test eax, eax
je 0x140057b8e
nop
test ebx, ebx
jne 0x140057b9e
mov r9d, eax
lea r8, [rbp + 0x660]
mov rdx, qword [rbp + 0x348]
lea rcx, [rbp + 0x340]
call fcn.14005aec0
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
lea r9, [rbp + 0x318]
mov r8d, 0x400
lea rdx, [rbp + 0x660]
call qword [rax + 0x18]
mov ebx, eax
mov eax, dword [rbp + 0x318]
test eax, eax
jne 0x140057b40
mov rcx, qword [rbp + 0x310]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebx, r12d
mov rdx, qword [rbp + 0x338]
cmp rdx, 0xf
jbe 0x140057be2
inc rdx
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057bdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057bdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
call fcn.14004f070
test ebx, ebx
jne 0x140057cdb
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x320]
call fcn.14004e530
nop
lea r8, [0x1400a1990]
lea rdx, str.javaw.exe__Xmx
lea rcx, [rbp + 0x2f0]
call fcn.140059a10
nop
lea r8, str.M__Djava.library.pathC:_boostanullclient_1_16_5_natives__cp_C:_boostanullclient_1_16_5libraries_
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140059b70
nop
lea r8, [rbp + 0x320]
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140059be0
nop
lea r8, str._net.minecraft.client.main.Main___username_dolphinsecurity___width_854___height_480___version_ForgeOptifine_1.16.5___gameDir_C:_boostanullclient_1_16_5___assetsDir_C:_boostanullclient_1_16_5_assets___assetIndex_1.16___uuid_NA___accessToken_aeef7bc935f9420eb6314dea7ad7e1e5___userType_mojang
mov rdx, rax
lea rcx, [rbp + 0x520]
call fcn.140059b70
nop
lea rcx, [rbp + 0x2b0]
call fcn.140059070
nop
lea rcx, [rbp + 0x2d0]
call fcn.140059070
nop
lea rcx, [rbp + 0x2f0]
call fcn.140059070
lea rcx, [rbp + 0x520]
call fcn.140058eb0
mov rcx, rax
lea edx, [rbx + 5]
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x320]
call fcn.140058eb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140059c90
lea rdx, [0x140059ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov byte [0x1400710d8], 1
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x140057d42
mov rdx, qword [rbp + 0x350]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057d3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x410], rax
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov rax, rcx
mov dword [rbp + rcx + 0x40c], edx
lea rcx, [rbp + 0x418]
call fcn.140058b90
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
cmp r14, 0xf
jbe 0x140057dd9
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140057dd0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057dd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14005b774
nop
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x140057e1d
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057e18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057e18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
mov rcx, qword [rbp + 0xa60]
xor rcx, rsp
call fcn.14005b360
lea r11, [rsp + 0xae0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140046d10
nop
call fcn.140046c70
nop
call fcn.140046c70
nop
call fcn.140046d10
int3