Function at 0x14002a730
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400c8080]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r14, r9
mov esi, r8d
mov r12, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov r15, qword [rbp + 0x7f]
cmp r8d, 0x113
ja 0x14002adf9
je 0x14002abd4
cmp r8d, 0x10
ja 0x14002a831
je 0x14002a825
mov eax, r8d
sub eax, 2
je 0x14002a818
sub eax, 1
je 0x14002a7cb
cmp eax, 0xc
jne 0x14002ae18
lea rdx, [rbp - 0x41]
mov rcx, r12
call qword [sym.imp.USER32.dll_BeginPaint]
lea rdx, [rbp - 0x41]
mov rcx, r12
call qword [sym.imp.USER32.dll_EndPaint]
jmp 0x14002ae84
cmp qword [rcx + 0x3f0], rbx
je 0x14002ae84
lea rdx, [rbp - 0x79]
mov rcx, qword [rcx + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x6d]
mov r8d, dword [rbp - 0x75]
sub eax, r8d
mov r9d, dword [rbp - 0x71]
mov edx, dword [rbp - 0x79]
sub r9d, edx
mov rcx, qword [rdi + 0x3f0]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x14002ae84
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x14002ae84
mov dl, 1
call fcn.14002aed0
jmp 0x14002ae84
cmp esi, 0x20
je 0x14002abad
cmp esi, 0x111
jne 0x14002ae18
cmp r14, 0xa2
ja 0x14002a8d6
je 0x14002a8c3
mov rax, r14
sub rax, 0x8e
je 0x14002a89c
sub rax, 2
je 0x14002a880
cmp rax, 0x10
jne 0x14002a8f7
xor edx, edx
call fcn.14002b090
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov rax, qword [rcx + 0x90]
movzx edx, byte [rax + 0x82]
call fcn.14002a4d0
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov rax, qword [rcx + 0x88]
cmp byte [rax + 0x82], bl
setne bl
add rcx, 0x260
mov edx, ebx
call fcn.140019b80
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov edx, 1
call fcn.14002b090
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov rax, r14
sub rax, 0xa4
je 0x14002ab9a
sub rax, 1
je 0x14002ab76
cmp rax, 0xc2b0
je 0x14002a905
mov r9, qword [rbp + 0x7f]
mov edx, 0x111
jmp 0x14002ae89
cmp dword [0x1400cdf90], 2
jne 0x14002a91a
cmp byte [0x1400cdb9f], bl
je 0x14002aa89
mov rdx, qword [0x1400cdf20]
test rdx, rdx
je 0x14002aa89
movdqa xmm0, xmmword [0x1400b0b40]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
mov dword [rbp - 0x79], 1
add rdx, 0x1e
lea rcx, [rbp - 0x69]
call fcn.14000d330
mov r8d, 0x1e
lea rdx, str.http:__bbs.3dmgame.com_thread_
lea rcx, [rbp - 0x69]
call fcn.140005730
lea rdx, [0x1400cdf10]
cmp qword [0x1400cdf28], 0x10
cmovae rdx, qword [0x1400cdf10]
mov r8, qword [0x1400cdf20]
lea rcx, [rbp - 0x69]
call fcn.140005730
mov r8d, 9
lea rdx, str._1_1.html
lea rcx, [rbp - 0x69]
call fcn.140005730
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002aa33
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aa2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aebf
call fcn.14004d9a4
movdqa xmm0, xmmword [0x1400b0b40]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x14002ae18
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ab68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aeb9
jmp 0x14002ab68
mov rdx, qword [0x1400cdf80]
test rdx, rdx
je 0x14002ae18
movdqa xmm0, xmmword [0x1400b0b40]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov dword [rbp - 0x79], 4
add rdx, 0x1c
lea rcx, [rsp + 0x38]
call fcn.14000d330
mov r8d, 0x1c
lea rdx, str.http:__flingtrainer.com_tag_
lea rcx, [rsp + 0x38]
call fcn.140005730
lea rdx, [0x1400cdf70]
cmp qword [0x1400cdf88], 0x10
cmovae rdx, qword [0x1400cdf70]
mov r8, qword [0x1400cdf80]
lea rcx, [rsp + 0x38]
call fcn.140005730
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002ae18
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ab68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aeb3
call fcn.14004d9a4
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov dl, 1
call fcn.14002aed0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov edx, 2
call fcn.14002b090
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14002abc6
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x14002ae95
mov r9, qword [rbp + 0x7f]
mov edx, 0x20
jmp 0x14002ae89
mov rax, r14
sub rax, 0x2710
je 0x14002ad98
sub rax, 1
je 0x14002ad8e
sub rax, 1
je 0x14002ad10
sub rax, 1
je 0x14002acea
cmp rax, 1
je 0x14002ac15
mov r9, qword [rbp + 0x7f]
mov edx, 0x113
jmp 0x14002ae89
cmp byte [rcx + 0x3e8], bl
sete al
mov byte [rcx + 0x3e8], al
mov ecx, 0x1000
call fcn.14004e010
mov rbx, rax
mov qword [rbp - 0x79], rax
cmp byte [rdi + 0x3e8], 0
je 0x14002ac51
lea r9, [rdi + 0x348]
cmp qword [r9 + 0x18], 8
jb 0x14002ac58
mov r9, qword [r9]
jmp 0x14002ac58
lea r9, [0x1400ac068]
lea rax, [0x1400cdef0]
cmp qword [0x1400cdf08], 8
cmovae rax, qword [0x1400cdef0]
lea r8, [0x1400cdd10]
cmp qword [0x1400cdd28], 8
cmovae r8, qword [0x1400cdd10]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + 0x128]
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, rbx
call fcn.140026070
mov rcx, qword [rdi + 0xb0]
add rcx, 0x48
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x14002acb4
mov rdx, rbx
call fcn.1400051b0
movzx edx, byte [rdi + 0x58]
mov rcx, rdi
call fcn.140020260
nop
test rbx, rbx
je 0x14002ae84
mov rcx, rbx
call fcn.14004d9a4
jmp 0x14002ae84
mov rax, qword [rcx + 0xb8]
mov byte [rax + 0x8c], 5
mov dword [rax + 0x88], 2
movzx edx, byte [rcx + 0x58]
call fcn.140020260
jmp 0x14002ae84
mov ecx, 0x11
call qword [0x1400cda98]
shr eax, 0xf
test al, 1
je 0x14002ad71
mov ecx, 0x10
call qword [0x1400cda98]
shr eax, 0xf
test al, 1
je 0x14002ad71
mov ecx, 0x24
call qword [0x1400cda98]
shr eax, 0xf
and al, 1
je 0x14002ad6b
cmp byte [0x1400cdac4], bl
jne 0x14002ad6b
mov byte [0x1400cdac4], 1
cmp byte [rdi + 0x3e9], bl
sete cl
mov byte [rdi + 0x3e9], cl
call fcn.14000fb60
jmp 0x14002ad71
mov byte [0x1400cdac4], al
cmp byte [rdi + 0x3e9], bl
je 0x14002ae84
lea rcx, [rdi + 0xd8]
call fcn.14001bd10
jmp 0x14002ae84
call fcn.14002b450
jmp 0x14002ae84
movzx eax, byte [rcx + 0x58]
cmp al, 0xfa
jae 0x14002ada4
mov bl, 5
jmp 0x14002ada9
movzx ebx, al
not bl
add bl, al
mov byte [rcx + 0x58], bl
movzx edx, bl
call fcn.140020260
mov rcx, qword [rdi + 0x3f0]
test rcx, rcx
je 0x14002addb
mov r9d, 3
movzx r8d, bl
mov edx, 0xff00ff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
cmp byte [rdi + 0x58], 0xff
jne 0x14002ae84
mov edx, 0x2710
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x14002ae84
mov eax, esi
sub eax, 0x200
je 0x14002ae6e
sub eax, 1
je 0x14002ae56
sub eax, 1
je 0x14002ae3e
sub eax, 3
je 0x14002ae26
cmp eax, 0x9e
je 0x14002ae1e
mov r9, qword [rbp + 0x7f]
jmp 0x14002ae87
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14002ae84
mov r9, qword [rcx]
mov rax, r15
shr rax, 0x10
movsx r8d, ax
movsx edx, r15w
call qword [r9 + 0x28]
jmp 0x14002ae84
mov r9, qword [rcx]
mov rax, r15
shr rax, 0x10
movsx r8d, ax
movsx edx, r15w
call qword [r9 + 0x20]
jmp 0x14002ae84
mov r9, qword [rcx]
mov rax, r15
shr rax, 0x10
movsx r8d, ax
movsx edx, r15w
call qword [r9 + 0x18]
jmp 0x14002ae84
mov r10, qword [rcx]
mov rax, r15
shr rax, 0x10
movsx r8d, ax
movsx edx, r15w
call qword [r10 + 0x10]
mov r9, r15
mov edx, esi
mov r8, r14
mov rcx, r12
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14004d980
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14006ef3c
int3
call fcn.14006ef3c
nop
call fcn.14006ef3c
nop
int3