Function at 0x14007ba60
Capabilities:
Access peb ldr_data
Create thread
Delete file
Encode data using xor
Enumerate gui resources
Execute command
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1401adf80]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r14d, r14d
call fcn.14007ae40
mov rax, qword [0x1401bf920]
test rax, rax
jne 0x14007bb66
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14007bb47
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14007bb47
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14007bb42
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x14007bb20
cmp edx, 0x694a8c81
je 0x14007bc1a
test r8d, r8d
jne 0x14007bb00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14007bb5c
cmp qword [rax + 0x30], r14
jne 0x14007bad0
mov rax, r14
mov qword [0x1401bf920], rax
call rax
test eax, eax
je 0x14007bb71
call fcn.14007acc0
call fcn.14007aed0
test al, al
je 0x14007bb7f
call fcn.14007acc0
call fcn.14007b350
mov dword [rbp - 0x20], r14d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [rbp - 0x1c], 0x1a0054
lea r8, [rbp - 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp + 0x2e]
sub cx, word [rbp + 0x2a]
inc cx
mov word [rbp - 0x20], cx
movzx ecx, word [rbp + 0x30]
sub cx, word [rbp + 0x2c]
inc cx
mov word [rbp - 0x1e], cx
mov edx, dword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea rcx, [0x1401be740]
call fcn.1400d07c0
cmp byte [0x1401be950], r14b
jne 0x14007bc36
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x14007bb5f
call fcn.14007b350
mov dword [rsp + 0x60], 0xa2bcac
mov byte [rsp + 0x64], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 3
jb 0x14007bc50
mov byte [rsp + 0x64], r14b
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401be740]
call fcn.1400cddd0
mov rsi, qword [0x1401bf2f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14007d0ee
lea r13, [0x1401bf2e0]
mov r12, r13
cmp qword [0x1401bf2f8], 0x10
cmovae r12, qword [0x1401bf2e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea r15, [rsi + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x78]
lea eax, [rbx + 7]
lea rdx, [rbx - 0x10]
cmp r15, rbx
jbe 0x14007bd4d
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14007bcf0
mov rbx, rcx
jmp 0x14007bcf7
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14007bd37
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d0f4
mov rcx, rax
call fcn.140125850
test rax, rax
je 0x14007be5a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14007bd49
test rcx, rcx
je 0x14007bd46
call fcn.140125850
mov rdi, rax
jmp 0x14007bd49
mov rdi, r14
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x14016b380]
mov dword [rdi + 8], eax
movzx eax, word [0x14016b384]
mov word [rdi + 0xc], ax
movzx eax, byte [0x14016b386]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], r14b
mov rdi, qword [rbp - 0x68]
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
call fcn.14012513c
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14006fc70
nop
lea rcx, [rsp + 0x30]
call fcn.1400706f0
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14007be14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007be0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007be0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
movdqa xmm0, xmmword [0x14016c9f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14007be66
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007be61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007be61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
test bl, bl
je 0x14007bef6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov word [rsp + 0x68], 0xa
mov byte [rsp + 0x6a], 0
lea rdx, [rsp + 0x68]
mov rcx, qword [0x14012d550]
call fcn.140084180
movdqa xmm0, xmmword [0x14016cfb0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016ce30]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xdcdf8486
mov dword [rsp + 0x54], 0x100fedd
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x26
jb 0x14007bed0
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
mov ecx, 0x3e8
jmp 0x14007bf07
lea rcx, [0x1401be740]
call fcn.1400cddd0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
mov rsi, qword [0x1401bf2f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14007d0fa
mov r12, r13
cmp qword [0x1401bf2f8], 0x10
cmovae r12, qword [0x1401bf2e0]
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea r15, [rsi + 0xf]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x78]
cmp r15, rbx
jbe 0x14007bff1
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14007bf87
mov rbx, rcx
jmp 0x14007bf94
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14007bfdb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d100
mov rcx, rax
call fcn.140125850
test rax, rax
je 0x14007c0ff
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14007bfed
test rcx, rcx
je 0x14007bfea
call fcn.140125850
mov rdi, rax
jmp 0x14007bfed
mov rdi, r14
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rbx
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rdi], xmm0
mov eax, dword [0x14016b380]
mov dword [rdi + 8], eax
movzx eax, word [0x14016b384]
mov word [rdi + 0xc], ax
movzx eax, byte [0x14016b386]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov rdi, qword [rbp - 0x68]
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
call fcn.14012513c
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14006fc70
nop
lea rcx, [rsp + 0x30]
call fcn.1400706f0
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14007c0b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c0b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c0b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
movdqa xmm0, xmmword [0x14016c9f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14007c10b
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c106
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c106
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
test bl, bl
je 0x14007c470
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r15, qword [0x1401bf2f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xf
jb 0x14007d106
mov r12, r13
cmp qword [0x1401bf2f8], 0x10
cmovae r12, qword [0x1401bf2e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rsi, [r15 + 0xf]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rbp - 0x78]
cmp rsi, rdi
jbe 0x14007c1f7
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x14007c18a
mov rdi, rcx
jmp 0x14007c197
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14007c1e1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d10c
mov rcx, rax
call fcn.140125850
test rax, rax
je 0x14007c1da
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14007c1f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14007c1f0
call fcn.140125850
mov rbx, rax
jmp 0x14007c1f3
mov rbx, r14
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rdi
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rbx], xmm0
mov eax, dword [0x14016b380]
mov dword [rbx + 8], eax
movzx eax, word [0x14016b384]
mov word [rbx + 0xc], ax
movzx eax, byte [0x14016b386]
mov byte [rbx + 0xe], al
lea rcx, [rbx + 0xf]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x40]
call fcn.14007d3b0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14007c288
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c283
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
movdqa xmm0, xmmword [0x14016ca00]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x40]
call fcn.14008ac40
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14003a940
mov rdx, rax
lea rcx, [0x1401be740]
call fcn.1400d1eb0
cmp byte [0x1401be950], 0
jne 0x14007c611
mov rsi, qword [0x1401bf2f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14007d112
mov r12, r13
cmp qword [0x1401bf2f8], 0x10
cmovae r12, qword [0x1401bf2e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r15, [rsi + 0xf]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rbp - 0x40]
cmp r15, rdi
jbe 0x14007c3bb
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x14007c351
mov rdi, rcx
jmp 0x14007c35e
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14007c3a5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d118
mov rcx, rax
call fcn.140125850
test rax, rax
je 0x14007c447
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14007c3b7
test rcx, rcx
je 0x14007c3b4
call fcn.140125850
mov rbx, rax
jmp 0x14007c3b7
mov rbx, r14
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rdi
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rbx], xmm0
mov eax, dword [0x14016b380]
mov dword [rbx + 8], eax
movzx eax, word [0x14016b384]
mov word [rbx + 0xc], ax
movzx eax, byte [0x14016b386]
mov byte [rbx + 0xe], al
lea rcx, [rbx + 0xf]
mov r8, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14007c453
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c44e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c44e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
movdqa xmm0, xmmword [0x14016ca00]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rcx, [rbp + 0x40]
call fcn.140073070
nop dword [rax]
mov word [rsp + 0x6c], 0xa
mov byte [rsp + 0x6e], 0
lea rdx, [rsp + 0x6c]
mov rcx, qword [0x14012d550]
call fcn.140084180
movdqa xmm0, xmmword [0x14016dab0]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x100eaf1
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x14007c4b0
mov byte [rbp - 0x2d], 0
mov edx, 6
mov rcx, qword [0x1401babc8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x58], 0xf1eef1
mov byte [rsp + 0x5c], 1
mov rdx, r14
nop word [rax + rax]
lea eax, [rdx - 0x31]
xor byte [rsp + rdx + 0x58], al
inc rdx
cmp rdx, 3
jb 0x14007c4f0
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [0x14012d550]
call fcn.140084180
mov edx, 7
mov rcx, qword [0x1401babc8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x40]
mov rcx, qword [0x14012d550]
call fcn.140084180
lea rdx, [rbp - 0x10]
mov rcx, qword [0x14012d560]
call fcn.140084620
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14003a940
mov rdx, rax
lea rcx, [0x1401be740]
call fcn.1400d1eb0
mov rcx, qword [0x14012d550]
cmp byte [0x1401be950], 0
jne 0x14007c61f
mov word [rsp + 0x70], 0xa
mov byte [rsp + 0x72], 0
lea rdx, [rsp + 0x70]
call fcn.140084180
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x14016dad0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016ce50]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xd3959983
mov word [rsp + 0x54], 0xf9
mov byte [rsp + 0x56], 1
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x14007c5d0
mov byte [rsp + 0x56], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
mov word [rsp + 0x74], 0xa
mov byte [rsp + 0x76], 0
lea rdx, [rsp + 0x74]
mov rcx, qword [0x14012d550]
call fcn.140084180
jmp 0x14007c470
lea rcx, [rbp + 0x40]
call fcn.140073070
jmp 0x14007c8ba
mov word [rsp + 0x78], 0xa
mov byte [rsp + 0x7a], 0
lea rdx, [rsp + 0x78]
call fcn.140084180
movdqa xmm0, xmmword [0x14016cfa0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016ce40]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xdcdf8486
mov dword [rsp + 0x54], 0x100fedd
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x26
jb 0x14007c670
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
mov word [rsp + 0x7c], 0xa
mov byte [rsp + 0x7e], 0
lea rdx, [rsp + 0x7c]
mov rcx, qword [0x14012d550]
call fcn.140084180
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r15, qword [0x1401bf2f0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xf
jb 0x14007d0e8
cmp qword [0x1401bf2f8], 0x10
cmovae r13, qword [0x1401bf2e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea rsi, [r15 + 0xf]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rbp - 0x40]
cmp rsi, rdi
jbe 0x14007c78d
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x14007c720
mov rdi, rcx
jmp 0x14007c72d
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14007c777
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d0e2
mov rcx, rax
call fcn.140125850
test rax, rax
je 0x14007c770
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14007c789
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14007c786
call fcn.140125850
mov rbx, rax
jmp 0x14007c789
mov rbx, r14
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
movsd xmm0, qword [str.C:ProgramData_]
movsd qword [rbx], xmm0
mov eax, dword [0x14016b380]
mov dword [rbx + 8], eax
movzx eax, word [0x14016b384]
mov word [rbx + 0xc], ax
movzx eax, byte [0x14016b386]
mov byte [rbx + 0xe], al
lea rcx, [rbx + 0xf]
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.14007e140
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14007c81e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c819
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp + 0x40]
call fcn.14008adf0
lea rcx, [rbp + 0x48]
call fcn.14007fd80
test rax, rax
jne 0x14007c874
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.14007e0d0
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
cmp byte [0x1401be950], 0
jne 0x14007c8d7
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14016d450]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x9a8585bb
mov word [rbp - 0x2c], 0x100
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x14
jb 0x14007c900
mov byte [rbp - 0x2b], 0
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x14007c96e
call fcn.14007b7a0
movdqa xmm0, xmmword [0x14016d450]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x9a8585bb
mov word [rbp - 0x2c], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x14
jb 0x14007c950
mov byte [rbp - 0x2b], 0
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [rbp - 0x80], 0xa
mov byte [rbp - 0x7e], 0
lea rdx, [rbp - 0x80]
mov rcx, qword [0x14012d550]
call fcn.140084180
movdqa xmm0, xmmword [0x14016d010]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016cc10]
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x50], 1
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1f
jb 0x14007c9b0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
mov word [rbp - 0x7c], 0xa
mov byte [rbp - 0x7a], 0
lea rdx, [rbp - 0x7c]
mov rcx, qword [0x14012d550]
call fcn.140084180
movdqa xmm0, xmmword [0x14016cc30]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x30], 1
mov rdx, r14
nop dword [rax]
lea eax, [rdx - 0x31]
xor byte [rbp + rdx - 0x40], al
inc rdx
cmp rdx, 0xf
jb 0x14007ca00
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, Ordinal_301
lea ecx, [rdx + 0x19]
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1401baad0], 0
jne 0x14007caa0
movdqa xmm0, xmmword [0x14016ceb0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x14007ca60
mov byte [rbp - 0x2f], 0
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401baad0], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1401baad0], 0
je 0x14007ca41
nop dword [rax]
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14007caa0
call fcn.14003a220
call fcn.140070c70
mov ebx, eax
mov dword [0x1401baa58], ebx
mov dword [0x1401baa20], ebx
lea rcx, [0x1401bf9c0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14007cae5
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1401bfa0c], 0x7fffffff
jne 0x14007cb07
mov dword [0x1401bfa0c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rbp + 0x18], r14
mov rax, qword [0x1401baa18]
mov byte [rax + 2], 2
mov rax, qword [0x1401baa18]
mov qword [rax + 8], rbx
lea rdx, [rbp + 0x18]
mov rax, qword [0x1401baa18]
mov qword [rax + 0x18], rdx
lea rdx, str.UnityPlayer.dll
mov rax, qword [0x1401baa18]
mov qword [rax + 0x28], rdx
call fcn.14003a400
lea rcx, [0x1401bf9c0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rbp + 0x18]
mov qword [0x1401baac8], rax
xor edx, edx
lea rcx, [0x1400792b0]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [0x1401baaa0], 0
jne 0x14007cbff
movdqa xmm0, xmmword [0x14016d000]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016d530]
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x50], 0x100
nop
lea eax, [r14 - 0x31]
xor byte [rsp + r14 + 0x30], al
inc r14
cmp r14, 0x20
jb 0x14007cba0
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14007cc9d
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cc98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x14007cc92
call fcn.1400788b0
cmp qword [0x1401baad8], 0
jne 0x14007ccde
movdqa xmm0, xmmword [0x14016d000]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14016d4f0]
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x50], 0xe5
mov byte [rsp + 0x52], 1
nop word [rax + rax]
lea eax, [r14 - 0x31]
xor byte [rsp + r14 + 0x30], al
inc r14
cmp r14, 0x21
jb 0x14007cc40
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x30]
call fcn.14006eb40
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14007cc9d
inc rdx
mov rcx, qword [rbp - 0x10]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14007cc98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14007d0cf
call fcn.140125adc
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140125830
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400758f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140073130]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140074d80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov rcx, qword [0x1401baad8]
call fcn.1400b56e0
test eax, eax
jne 0x14007cf39
movss xmm7, dword [0x14016c864]
movss xmm6, dword [0x14016c82c]
nop dword [rax + rax]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14007cd63
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14007cdf0
cmp byte [reloc.WS2_32.dll_accept], 0
sete al
mov byte [reloc.WS2_32.dll_accept], al
movzx r8d, al
xor r8d, 1
mov edx, 0x2000d
mov rcx, qword [0x1401baad8]
call fcn.1400b6a60
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14007cdac
mov rcx, qword [0x1401baad8]
call fcn.1400bd520
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14007cde5
mov rcx, qword [0x1401baaa0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400b7280
cmp dword [0x1401bf7e8], 0
jne 0x14007ce03
call fcn.140063990
call fcn.140062ca0
call fcn.14003fb10
call fcn.140076140
cmp byte [0x1401bf7af], 0
je 0x14007ceae
cvttss2si esi, dword [0x1401b0e2c]
mov rax, qword [0x1401baa38]
movss xmm0, dword [rax + 0x14]
mulss xmm0, xmm6
cvttss2si edi, xmm0
movss xmm1, dword [rax + 0x10]
mulss xmm1, xmm6
cvttss2si ebx, xmm1
mov rax, qword [rax + 0x4040]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.14003e670
mov r8, rax
movaps xmm0, xmmword [0x14016ccc0]
movups xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call fcn.14003c640
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x58], xmm0
movd xmm1, edi
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x54], xmm1
movd xmm2, esi
cvtdq2ps xmm2, xmm2
movss dword [rsp + 0x28], xmm7
mov r9d, eax
lea rdx, [rbp - 0x58]
mov rcx, r8
call fcn.14005cef0
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14007cebc
call fcn.140079300
call fcn.140042570
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x18]
mov rcx, qword [0x1401baad8]
call fcn.1400b5e70
mov r9d, dword [rbp + 0x10]
mov r8d, dword [rbp - 0x18]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.OPENGL32.dll_glViewport]
mov ecx, 0x4000
call qword [sym.imp.OPENGL32.dll_glClear]
mov rax, qword [0x1401baa38]
mov rax, qword [rax + 0x4040]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r14
cmp byte [rcx], r14b
cmovne rax, rcx
mov rcx, rax
call fcn.140063270
mov rcx, qword [0x1401baad8]
call fcn.1400be020
mov rcx, qword [0x1401baad8]
call fcn.1400b56e0
test eax, eax
je 0x14007cd40
cmp dword [0x1401bf7dc], 0
je 0x14007cf5b
lea rdx, [0x1401bf7dc]
mov ecx, 1
call qword [0x1401b7098]
mov dword [0x1401bf7dc], r14d
cmp dword [0x1401bf7d4], 0
je 0x14007cf7d
lea rdx, [0x1401bf7d4]
mov ecx, 1
call qword [0x1401b7098]
mov dword [0x1401bf7d4], r14d
mov ecx, dword [0x1401bf7e8]
test ecx, ecx
je 0x14007cf94
call qword [0x1401b72b8]
mov dword [0x1401bf7e8], r14d
cmp dword [0x1401bf7d8], 0
je 0x14007cfc5
mov rbx, qword [0x1401baa38]
lea rdx, [0x1401bf7d8]
mov ecx, 1
call qword [sym.imp.OPENGL32.dll_glDeleteTextures]
mov rax, qword [rbx + 0x50]
mov qword [rax + 8], r14
mov dword [0x1401bf7d8], r14d
cmp byte [0x1401bab84], 0
je 0x14007d021
mov rdx, qword [0x1401bf7b0]
mov rcx, qword [0x1401bf7c0]
call fcn.1400b1cb0
mov rdx, qword [0x1401bf758]
mov rcx, qword [0x1401bf7c0]
call fcn.1400b1e90
mov rdx, qword [0x1401bf7b8]
mov rcx, qword [0x1401bf7c0]
call fcn.1400b1ad0
mov rdx, qword [0x1401bf750]
mov rcx, qword [0x1401bf7c0]
call fcn.1400b1b70
mov byte [0x1401bab84], 0
lea rbx, [0x1401bf760]
lea rdi, [0x1401bf7a8]
nop
mov rcx, qword [rbx]
call fcn.1400b1960
mov qword [rbx], r14
add rbx, 8
cmp rbx, rdi
jl 0x14007d030
mov rbx, qword [0x1401baa38]
mov rcx, rbx
call fcn.140040fd0
cmp qword [0x1401baa38], rbx
jne 0x14007d063
mov qword [0x1401baa38], r14
test rbx, rbx
je 0x14007d08b
mov rcx, rbx
call fcn.140051360
mov rax, qword [0x1401baa38]
test rax, rax
je 0x14007d082
dec dword [rax + 0xec]
mov rcx, rbx
call qword [0x14012de50]
mov rcx, qword [0x1401baad8]
call fcn.1400b5610
call fcn.1400bd690
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14007d0db
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d0d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007d0d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140125adc
xor eax, eax
jmp 0x14007cca4
call fcn.14003a530
int3
call fcn.14003a5d0
nop
call fcn.14003a5d0
int3
call fcn.14003a530
nop
call fcn.14003a5d0
int3
call fcn.14003a530
int3
call fcn.14003a5d0
int3
call fcn.14003a530
nop
call fcn.14003a5d0
int3
call fcn.14003a530
int3