Function at 0x140003d00
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rsi, rcx
mov qword [rbp - 8], rcx
xor r13d, r13d
mov word [rsp + 0x40], 0x60
mov byte [rsp + 0x42], r13b
lea rax, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003d60
mov rdx, qword [0x1401246a0]
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, rdx
cmp rax, rcx
jb 0x140004783
lea rax, [0x140124690]
cmp qword [0x1401246a8], 0x10
cmovae rax, qword [0x140124690]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.140026970
lea rdx, [rbp + 0x30]
lea rcx, [0x1401242c8]
call fcn.1400238f0
lea rcx, [rbp + 0x30]
call fcn.1400245d0
mov word [rsp + 0x40], 0x60
mov byte [rsp + 0x42], 0
lea rax, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003df0
mov r8, qword [0x140124720]
mov rax, r15
sub rax, r8
cmp rax, rcx
jb 0x140004783
lea rax, [0x140124710]
cmp qword [0x140124728], 0x10
cmovae rax, qword [0x140124710]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.140026970
lea rdx, [rbp + 0x30]
lea rcx, [0x140124368]
call fcn.1400238f0
lea rcx, [rbp + 0x30]
call fcn.1400245d0
lea rdx, [0x1401242c8]
lea rcx, [rbp + 0x70]
call fcn.1400239f0
nop
lea rdx, [0x140124368]
lea rcx, [rbp + 0x90]
call fcn.1400239f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
lea rdx, [0x1400e8237]
lea rcx, [rbp + 0x50]
call fcn.140025ca0
nop
mov rcx, rsi
mov rdi, qword [rsi + 0x18]
cmp rdi, 0x10
jb 0x140003eb4
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x10]
cmp rbx, 3
jne 0x140003efc
mov r8, rbx
lea rdx, [0x1400e829c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003efc
lea r8d, [rbx + 5]
lea rdx, str.worldban
mov rcx, rsi
call fcn.1400246a0
mov r8, rbx
lea rdx, [0x1400e82ac]
lea rcx, [rbp + 0x50]
call fcn.1400246a0
jmp 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x140003f08
mov rcx, qword [rsi]
cmp rbx, 4
jne 0x140003f21
mov r8, rbx
lea rdx, str.kick
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003f46
mov rcx, rsi
cmp rdi, 0x10
jb 0x140003f2d
mov rcx, qword [rsi]
cmp rbx, 4
jne 0x140003f76
mov r8, rbx
lea rdx, str.kill
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003f76
mov r8d, 4
lea rdx, str.kick
mov rcx, rsi
call fcn.1400246a0
mov r8d, 4
lea rdx, str.Kick
lea rcx, [rbp + 0x50]
call fcn.1400246a0
jmp 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x140003f82
mov rcx, qword [rsi]
cmp rbx, 4
jne 0x140003fb3
mov r8, rbx
lea rdx, str.pull
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003fb3
mov r8, rbx
lea rdx, str.Pull
lea rcx, [rbp + 0x50]
call fcn.1400246a0
jmp 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x140003fbf
mov rcx, qword [rsi]
cmp rbx, 5
jne 0x140003fed
mov r8, rbx
lea rdx, str.trade
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003fed
mov r8, rbx
lea rdx, str.Trade
lea rcx, [rbp + 0x50]
call fcn.1400246a0
jmp 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x140003ff9
mov rcx, qword [rsi]
cmp rbx, 4
jne 0x140004012
mov r8, rbx
lea rdx, str.kick
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x14000401e
mov rcx, qword [rsi]
cmp rbx, 4
jne 0x140004037
mov r8, rbx
lea rdx, str.pull
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004064
mov rcx, rsi
cmp rdi, 0x10
jb 0x140004043
mov rcx, qword [rsi]
cmp rbx, 5
jne 0x1400046f5
mov r8, rbx
lea rdx, str.trade
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400046f5
mov ebx, r13d
mov rax, qword [0x140124ae0]
mov rdi, qword [rax + 0x160]
mov r12, qword [rax + 0x168]
cmp rdi, r12
je 0x1400044a7
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov rax, qword [rdi + 0x10]
cmp rax, 2
jb 0x140004789
add rax, 0xfffffffffffffffe
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400040cc
mov rdx, qword [rdi]
add rdx, 2
lea rcx, [rbp + 0x30]
call fcn.140025ca0
nop
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400239f0
nop
mov r14d, dword [rdi + 0x40]
mov rax, qword [0x140124ae0]
cmp r14d, dword [rax + 0x1b8]
je 0x140004487
mov dword [rsp + 0x40], 0x1004c5a
mov rcx, r13
nop word [rax + rax]
lea eax, [rcx + 0x3a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140004110
mov byte [rsp + 0x43], 0
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140004131
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rbp + 0x20]
call fcn.140025bb0
cmp rax, 0xffffffffffffffff
je 0x140004487
inc ebx
mov byte [0x140123a3d], 1
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.1400030e0
mov rdx, rax
movdqa xmm0, xmmword [0x1400f6dd0]
movdqu xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], 0x29253f2f
mov word [rbp + 0xc4], gethostbyname
mov byte [rbp + 0xc6], 1
mov rcx, r13
nop
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx + 0xb0], al
inc rcx
cmp rcx, 0x15
jb 0x1400041b0
mov byte [rbp + 0xc6], 0
lea rax, [rbp + 0xb0]
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400041e0
lea r8, [rbp + 0xb0]
mov rcx, rdx
call fcn.140026c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9d, 2
lea r8, [rsp + 0x48]
xor edx, edx
call fcn.1400cbfd0
nop
lea rcx, [rsp + 0x68]
call fcn.1400245d0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov r14, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp r14, 0x989680
jne 0x140004266
imul rax, rax, 0x64
jmp 0x140004281
cqo
idiv r14
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv r14
add rax, rcx
movabs rcx, 0x7fffffffffb3b4bf
cmp rax, rcx
jge 0x14000429c
add rax, 0x4c4b40
mov qword [rbp], rax
jmp 0x1400042a0
mov qword [rbp], r15
lea rcx, [rbp]
call fcn.1400275e0
mov edx, dword [rdi + 0x40]
lea rcx, [rbp - 0x28]
call fcn.1400030e0
mov rdx, rax
movdqa xmm0, xmmword [0x1400f6f20]
movdqu xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x1400f7400]
movdqu xmmword [rbp - 0x68], xmm1
mov dword [rbp - 0x58], 0x2d332b26
mov dword [rbp - 0x54], 0xf6a2f2b
mov dword [rbp - 0x50], 0x212d1707
mov word [rbp - 0x4c], 0x1a
mov byte [rbp - 0x4a], 1
mov rcx, r13
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 0x2d
jb 0x140004300
mov byte [rbp - 0x4a], 0
lea rax, [rbp - 0x78]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rax + r9], 0
jne 0x140004320
lea r8, [rbp - 0x78]
mov rcx, rdx
call fcn.140026c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
movdqa xmm0, xmmword [0x1400f71a0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xc0], 0x100
mov rax, r13
lea ecx, [rax + 0x3a]
xor byte [rbp + rax + 0xb0], cl
inc rax
cmp rax, 0x10
jb 0x140004383
mov byte [rbp + 0xc1], 0
lea rax, [rbp + 0xb0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400043b0
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.140024800
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140004405
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x48]
call fcn.140024800
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9d, 2
lea r8, [rsp + 0x48]
xor edx, edx
call fcn.1400cbfd0
nop
lea rcx, [rbp - 0x48]
call fcn.1400245d0
nop
lea rcx, [rsp + 0x68]
call fcn.1400245d0
nop
lea rcx, [rbp - 0x28]
call fcn.1400245d0
mov qword [rbp], 5
lea rcx, [rbp]
call fcn.1400251c0
nop
lea rcx, [rbp + 0x10]
call fcn.1400245d0
nop
lea rcx, [rbp + 0x30]
call fcn.1400245d0
add rdi, 0x58
cmp rdi, r12
jne 0x140004090
lea r9, [rbp + 0xc5]
test ebx, ebx
jns 0x1400044f0
neg ebx
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400044c0
dec r9
mov byte [r9], 0x2d
jmp 0x140004516
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400044f0
lea r8, [rbp + 0xc5]
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.1400272f0
nop
mov rcx, qword [rbp + 0x80]
sub r15, rcx
mov rdx, qword [rbp + 0x60]
cmp r15, rdx
jb 0x14000477d
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae r9, qword [rbp + 0x70]
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rax, qword [rbp + 0x50]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x48]
call fcn.140026970
nop
mov r8d, listen
lea rdx, str._Sent_To__w
lea rcx, [rbp - 0x48]
call fcn.140024800
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140026780
nop
mov r8d, 8
lea rdx, str._Players
lea rcx, [rbp + 0x10]
call fcn.140024800
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x68]
call fcn.140098e70
nop
lea rcx, [rbp + 0x10]
call fcn.1400245d0
nop
lea rcx, [rbp + 0x30]
call fcn.1400245d0
nop
lea rcx, [rbp - 0x48]
call fcn.1400245d0
nop
lea rcx, [rsp + 0x48]
call fcn.1400245d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, 0x2a
lea rdx, str._wNote:__4Dont_spam__w_...all__4features_
lea rcx, [rbp + 0x10]
call fcn.140025ca0
lea rcx, [rbp + 0x10]
call fcn.140098e70
mov ecx, 1
call fcn.1400cd110
mov qword [rbp], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140028190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x1400046e2
cmp dword [rbp + 0xb8], 0
jne 0x1400046bd
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400046e0
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
jmp 0x140004724
mov dword [rbp + 0xb8], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Type_not_found
lea rcx, [rbp + 0x10]
call fcn.140025ca0
lea rcx, [rbp + 0x10]
call fcn.140098e70
nop
lea rcx, [rbp + 0x50]
call fcn.1400245d0
nop
lea rcx, [rbp + 0x90]
call fcn.1400245d0
nop
lea rcx, [rbp + 0x70]
call fcn.1400245d0
nop
mov rcx, rsi
call fcn.1400245d0
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400cd0f0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003030
nop
call fcn.140003030
nop
call fcn.140024a90
int3