Function at 0x140203390
Capabilities:
Download url
Enumerate gui resources
Hide graphical window
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x918
mov rax, qword [0x14059a600]
xor rax, rsp
mov qword [rsp + 0x900], rax
mov dword [rsp + 0x30], 0
mov rcx, qword [0x1406b0b60]
call fcn.1400a2070
mov rcx, qword [0x1406b0b60]
call fcn.1400a20d0
lea rcx, str.Color_F
call fcn.1403eaa3c
lea rcx, str.MODE_Con_Cols56_lines16
call fcn.1403eaa3c
mov ecx, 0x88
call fcn.1403d5a80
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x1402034bb
mov edx, 0x88
mov rcx, qword [rsp + 0xa0]
call fcn.140068290
lea rdx, [0x140515e9c]
lea rcx, [rsp + 0x2e0]
call fcn.14006cb90
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rdx, str.DeviceXtreme
lea rcx, [rsp + 0x2a0]
call fcn.14006cb90
nop
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
lea rdx, [0x14052fa58]
lea rcx, [rsp + 0x2c0]
call fcn.14006cb90
nop
mov eax, dword [rsp + 0x30]
or eax, 4
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 0x2f70
lea rax, [0x140536430]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e0]
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0xa0]
call fcn.1401ff8a0
mov qword [rsp + 0xa8], rax
jmp 0x1402034c7
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x1406b0b68], rax
mov eax, dword [rsp + 0x30]
and eax, 4
test eax, eax
je 0x140203504
and dword [rsp + 0x30], 0xfffffffb
lea rcx, [rsp + 0x2c0]
call fcn.14006ca40
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x140203522
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0x2a0]
call fcn.14006ca40
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x14020353f
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x2e0]
call fcn.14006ca40
mov rcx, qword [0x1406b0b68]
call fcn.1401ffe10
lea rdx, str.C:windowsXtreme.sys
lea rcx, [rsp + 0x390]
call fcn.14006cb90
nop
lea rdx, str.Xtreme
lea rcx, [rsp + 0x370]
call fcn.14006cb90
nop
lea rdx, [0x1402001f0]
lea rcx, [0x1406ade90]
call fcn.140082200
mov qword [rsp + 0xc0], rax
lea rdx, str.___Check_fonts...
lea rcx, [rsp + 0x250]
call fcn.14006cb90
mov dword [rsp + 0x270], Ordinal_27
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0xc0]
call fcn.1402032e0
nop
lea rcx, [rsp + 0x250]
call fcn.140080250
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:eomax.ttf
lea rdx, str.https:__eomaxx.com_font_eomaxonlin.ttf
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140203630
lea rdx, str.DOWNLOAD_STARTED
lea rcx, [0x1406ade90]
call fcn.140092850
mov qword [rsp + 0xc8], rax
lea rdx, [0x1400892c0]
mov rcx, qword [rsp + 0xc8]
call fcn.140082200
jmp 0x140203669
cmp dword [rsp + 0x40], 0x800c0008
jne 0x140203669
lea rdx, str.DOWNLOAD_ERROR
lea rcx, [0x1406ade90]
call fcn.140092850
mov qword [rsp + 0xd0], rax
lea rdx, [0x1400892c0]
mov rcx, qword [rsp + 0xd0]
call fcn.140082200
lea rdx, [0x1402001b0]
lea rcx, [0x1406ade90]
call fcn.140082200
mov qword [rsp + 0xd8], rax
lea rdx, str._Ok._n
lea rcx, [rsp + 0x278]
call fcn.14006cb90
mov dword [rsp + 0x298], reloc.WLDAP32.dll_Ordinal_30
lea rdx, [rsp + 0x278]
mov rcx, qword [rsp + 0xd8]
call fcn.1402032e0
nop
lea rcx, [rsp + 0x278]
call fcn.140080250
lea rax, [rsp + 0x700]
lea rcx, [0x14052fcb8]
mov rdi, rax
mov rsi, rcx
mov ecx, Ordinal_27
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x718]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rax, [rsp + 0x500]
lea rcx, str.AndroidProcess.exe
mov rdi, rax
mov rsi, rcx
mov ecx, Ordinal_41
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x526]
mov rdi, rax
xor eax, eax
mov ecx, 0x1da
rep stosb byte [rdi], al
lea rcx, [rsp + 0x500]
call fcn.140213a80
mov dword [0x1406b0b4c], eax
cmp dword [0x1406b0b4c], 0
jle 0x14020374b
mov byte [0x1406b0b48], 1
jmp 0x14020376e
lea rcx, [rsp + 0x700]
call fcn.140213a80
mov dword [0x1406b0b4c], eax
cmp dword [0x1406b0b4c], 0
jle 0x14020376e
mov byte [0x1406b0b37], 1
cmp dword [0x1406b0b4c], 0
jne 0x1402037a7
mov r9d, 1
lea r8, [0x14052fca8]
lea rdx, str.Cant_Find_Game_Process
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [0x140557c00]
call fcn.1403eaa3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, dword [0x1406b0b4c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1406b0b40], rax
cmp qword [0x1406b0b40], 0
jne 0x14020381b
mov rcx, qword [0x1406b0b68]
call fcn.1401ffb50
lea rdx, str.Cant_find_game_process__press_any_key_to_exit_hack
lea rcx, [0x1406ade90]
call fcn.140092850
mov qword [rsp + 0xe0], rax
lea rdx, [0x1400892c0]
mov rcx, qword [rsp + 0xe0]
call fcn.140082200
lea rcx, [0x140557bf0]
call fcn.1403eaa3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, byte [0x1406b0b48]
cmp eax, 1
jne 0x1402038b2
xor edx, edx
lea rcx, [0x140204730]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14020385d
mov edx, 9
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, str.SmartGaGa_RenderWindow
lea r8, [0x140530278]
xor edx, edx
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1406b0b38], rax
lea rdx, [0x140530338]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
lea r9, [0x14052fed8]
lea r8, [0x14052ff98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1406b0b38], rax
jmp 0x140203914
movzx eax, byte [0x1406b0b37]
cmp eax, 1
jne 0x140203914
xor edx, edx
lea rcx, [0x140204730]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1402038f0
mov edx, 9
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, [0x14052ffc8]
lea r8, [0x14052fe28]
xor edx, edx
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1406b0b38], rax
cmp qword [0x1406b0b38], 0
jne 0x14020395a
lea rdx, [0x14052ff08]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0xe8], rax
lea r9, str.AEngineRenderWindow
lea r8, str.AEngineRenderWindowClass
xor edx, edx
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x1406b0b38], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x1406b0b4c]
call fcn.140203210
mov qword [0x1406b0b50], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0xb0], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0xb4], eax
lea rdx, [rsp + 0x320]
mov rcx, qword [0x1406b0b38]
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp qword [0x1406b0b38], 0
jne 0x1402039ed
mov r9d, 1
lea r8, str.Private
lea rdx, str.Cant_Find_Game_Window
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.pause__nul
call fcn.1403eaa3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, byte [0x1406b0b48]
cmp eax, 1
jne 0x140203a3e
mov edx, 0x90000000
mov ecx, 0x60000000
call fcn.140072a80
mov dword [0x1406afeb8], eax
cmp dword [0x1406afeb8], 0
jne 0x140203a35
mov edx, 0xa0000000
mov ecx, 0x90000000
call fcn.140072a80
mov dword [0x1406afeb8], eax
mov byte [0x1406b0b35], 1
jmp 0x140203a3c
mov byte [0x1406b0af7], 1
jmp 0x140203a8d
movzx eax, byte [0x1406b0b37]
cmp eax, 1
jne 0x140203a8d
mov edx, 0x90000000
mov ecx, 0x25000000
call fcn.140072a80
mov dword [0x1406afeb8], eax
cmp dword [0x1406afeb8], 0
jne 0x140203a86
mov edx, 0x35000000
mov ecx, 0x25000000
call fcn.140072a80
mov dword [0x1406afeb8], eax
mov byte [0x1406b0b36], 1
jmp 0x140203a8d
mov byte [0x1406b0b34], 1
mov eax, dword [0x14059c3d8]
mov dword [rsp + 0x98], eax
mov eax, dword [0x14059c3d4]
mov ecx, dword [rsp + 0x98]
add ecx, eax
mov eax, ecx
mov dword [0x1406afeb8], eax
cmp dword [0x1406afeb8], 0
jne 0x140203ac2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rdx, [0x1405308a8]
lea rcx, [rsp + 0x300]
call fcn.140204700
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0x350]
mov rcx, qword [rsp + 0xf0]
call fcn.140204900
nop
lea rdx, [0x140530738]
lea rcx, [rsp + 0x310]
call fcn.140204700
mov qword [rsp + 0xf8], rax
lea rdx, [rsp + 0x330]
mov rcx, qword [rsp + 0xf8]
call fcn.140204900
nop
mov eax, dword [rsp + 0x324]
mov ecx, dword [rsp + 0x32c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x320]
mov edx, dword [rsp + 0x328]
sub edx, ecx
mov ecx, edx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x324]
mov ecx, dword [rsp + 0x320]
call fcn.1400c24f0
mov r8d, dword [0x14059b3b4]
mov edx, dword [0x14059b3c4]
mov rcx, qword [0x1406b0a78]
call fcn.1400b9770
xor ecx, ecx
call fcn.140199c40
call fcn.140199dc0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x394], 0
lea rcx, [rsp + 0x3e0]
call fcn.1401c93d0
mov byte [rsp + 0x428], 1
mov byte [rsp + 0x400], 1
mov dword [rsp + 0x3f8], 2
mov dword [rsp + 0x3fc], 2
movss xmm0, dword [0x140565b84]
movss dword [rsp + 0x420], xmm0
lea rcx, [rsp + 0x470]
call fcn.1401c93d0
mov byte [rsp + 0x47c], 0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0x330]
call fcn.14006c8f0
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x140565b8c]
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
call fcn.1401c9e70
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x110], rax
lea rax, [0x140565720]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x140565b90]
mov r8d, 0x1e695
lea rdx, [0x1405393a0]
mov rcx, qword [rsp + 0x110]
call fcn.1401ca240
call fcn.140125ce0
call fcn.140200550
call fcn.140200580
call fcn.1402005d0
mov rcx, qword [0x1406b0a78]
call fcn.1401d4340
mov rcx, qword [0x1406b0768]
call fcn.1401d3c60
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.1401cd800
mov qword [rsp + 0x118], rax
lea rcx, [rsp + 0x330]
call fcn.14006c8f0
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x20], rax
xor r9d, r9d
movss xmm2, dword [0x140565b98]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x128]
call fcn.1401c9e70
mov qword [0x1406b0398], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x130], rax
lea rax, [0x140565720]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x140565b90]
mov r8d, 0x1e695
lea rdx, [0x1405393a0]
mov rcx, qword [rsp + 0x130]
call fcn.1401ca240
mov qword [0x1406b0390], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
movss xmm3, dword [0x140565bd4]
mov r8d, 0xa01
lea rdx, [0x140535a20]
mov rcx, qword [rsp + 0x138]
call fcn.1401ca240
mov qword [0x1406b0380], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
movss xmm3, dword [0x140565c58]
mov r8d, 0x42ac
lea rdx, [0x1406a1380]
mov rcx, qword [rsp + 0x140]
call fcn.1401ca0d0
mov qword [0x1406b03a0], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
movss xmm3, dword [0x140565bf4]
mov r8d, 0x42ac
lea rdx, [0x1406a1380]
mov rcx, qword [rsp + 0x148]
call fcn.1401ca0d0
mov qword [0x1406b0378], rax
lea rdx, [0x14007da00]
lea rcx, [rsp + 0x1d0]
call fcn.1402052d0
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x158], rax
mov rcx, qword [rsp + 0x158]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x1d0]
call fcn.1400a4660
lea rdx, [0x14007cfd0]
lea rcx, [rsp + 0x1e0]
call fcn.1402052d0
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x168]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x1e0]
call fcn.1400a4660
lea rdx, [0x14012ee00]
lea rcx, [rsp + 0x1f0]
call fcn.1402052d0
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0x178]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x1f0]
call fcn.1400a4660
lea rdx, [0x140207d40]
lea rcx, [rsp + 0x200]
call fcn.1402052d0
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0x188]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x200]
call fcn.1400a4660
lea rdx, [0x140068330]
lea rcx, [rsp + 0x210]
call fcn.1402052d0
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x198]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x210]
call fcn.1400a4660
lea rdx, [0x140208b50]
lea rcx, [rsp + 0x220]
call fcn.1402052d0
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x1a8], rax
mov rcx, qword [rsp + 0x1a8]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x220]
call fcn.1400a4660
lea rdx, [0x1402111f0]
lea rcx, [rsp + 0x230]
call fcn.1402052d0
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x1b8], rax
mov rcx, qword [rsp + 0x1b8]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x230]
call fcn.1400a4660
lea rdx, [0x1400dd380]
lea rcx, [rsp + 0x240]
call fcn.1402052d0
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x1c8], rax
mov rcx, qword [rsp + 0x1c8]
call fcn.1401ff6c0
nop
lea rcx, [rsp + 0x240]
call fcn.1400a4660
xor eax, eax
cmp eax, 1
je 0x1402046af
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1406b0a78]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14020410f
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x140204127
mov rcx, qword [0x1406b0a78]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204162
movzx eax, byte [0x1406b0b90]
test eax, eax
jne 0x14020414f
mov dword [rsp + 0x44], 1
jmp 0x140204157
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
mov byte [0x1406b0b90], al
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204246
movzx eax, byte [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1402041e5
mov rdx, qword [0x1406b0a78]
xor ecx, ecx
call fcn.1402143e0
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1402041a8
mov dword [rsp + 0x48], 1
jmp 0x1402041b0
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [0x1406b0c7c]
test eax, eax
jne 0x1402041d0
mov dword [rsp + 0x4c], 1
jmp 0x1402041d8
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0x4c]
mov byte [0x1406b0c7c], al
jmp 0x140204246
mov rdx, qword [0x1406b0a78]
mov ecx, 1
call fcn.1402143e0
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14020420b
mov dword [rsp + 0x50], 1
jmp 0x140204213
mov dword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [0x1406b0c7c]
test eax, eax
jne 0x140204233
mov dword [rsp + 0x54], 1
jmp 0x14020423b
mov dword [rsp + 0x54], 0
movzx eax, byte [rsp + 0x54]
mov byte [0x1406b0c7c], al
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14020432a
movzx eax, byte [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1402042c9
mov rdx, qword [0x1406b0a78]
xor ecx, ecx
call fcn.1402143e0
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14020428c
mov dword [rsp + 0x58], 1
jmp 0x140204294
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1402042b4
mov dword [rsp + 0x5c], 1
jmp 0x1402042bc
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14020432a
mov rdx, qword [0x1406b0a78]
mov ecx, 1
call fcn.1402143e0
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1402042ef
mov dword [rsp + 0x60], 1
jmp 0x1402042f7
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x140204317
mov dword [rsp + 0x64], 1
jmp 0x14020431f
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [reloc.WS2_32.dll_accept], al
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204365
movzx eax, byte [0x1406b0b92]
test eax, eax
jne 0x140204352
mov dword [rsp + 0x68], 1
jmp 0x14020435a
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [0x1406b0b92], al
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1402043c8
movzx eax, byte [0x1406b0b9d]
test eax, eax
jne 0x14020438d
mov dword [rsp + 0x6c], 1
jmp 0x140204395
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
mov byte [0x1406b0b9d], al
movzx eax, byte [0x1406b0b8d]
test eax, eax
jne 0x1402043b5
mov dword [rsp + 0x70], 1
jmp 0x1402043bd
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [0x1406b0b8d], al
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204403
movzx eax, byte [0x1406b0b8f]
test eax, eax
jne 0x1402043f0
mov dword [rsp + 0x74], 1
jmp 0x1402043f8
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
mov byte [0x1406b0b8f], al
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14020443e
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14020442b
mov dword [rsp + 0x78], 1
jmp 0x140204433
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
mov byte [reloc.WS2_32.dll_accept], al
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204510
movzx eax, byte [0x1406b0b8e]
test eax, eax
jne 0x14020446a
mov dword [rsp + 0x7c], 1
jmp 0x140204472
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
mov byte [0x1406b0b8e], al
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x140204495
mov dword [rsp + 0x80], 1
jmp 0x1402044a0
mov dword [rsp + 0x80], 0
movzx eax, byte [rsp + 0x80]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1402044c6
mov dword [rsp + 0x84], 1
jmp 0x1402044d1
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
mov byte [reloc.WS2_32.dll_accept], al
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1402044f7
mov dword [rsp + 0x88], 1
jmp 0x140204502
mov dword [rsp + 0x88], 0
movzx eax, byte [rsp + 0x88]
mov byte [reloc.WS2_32.dll_accept], al
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204554
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14020453b
mov dword [rsp + 0x8c], 1
jmp 0x140204546
mov dword [rsp + 0x8c], 0
movzx eax, byte [rsp + 0x8c]
mov byte [reloc.WS2_32.dll_accept], al
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204598
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14020457f
mov dword [rsp + 0x90], 1
jmp 0x14020458a
mov dword [rsp + 0x90], 0
movzx eax, byte [rsp + 0x90]
mov byte [reloc.WS2_32.dll_accept], al
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204616
cmp dword [reloc.WS2_32.dll_closesocket], 0
jne 0x1402045c4
mov eax, dword [reloc.WS2_32.dll_closesocket]
inc eax
mov dword [reloc.WS2_32.dll_closesocket], eax
jmp 0x140204616
cmp dword [reloc.WS2_32.dll_closesocket], 1
jne 0x1402045d9
mov dword [reloc.WS2_32.dll_closesocket], 2
jmp 0x140204616
cmp dword [reloc.WS2_32.dll_closesocket], 2
jne 0x1402045ee
mov dword [reloc.WS2_32.dll_closesocket], 3
jmp 0x140204616
cmp dword [reloc.WS2_32.dll_closesocket], 3
jne 0x140204603
mov dword [reloc.WS2_32.dll_closesocket], 4
jmp 0x140204616
cmp dword [reloc.WS2_32.dll_closesocket], 4
jne 0x140204616
mov dword [reloc.WS2_32.dll_closesocket], 0
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140204666
movzx eax, byte [0x1406b0b9d]
test eax, eax
je 0x140204644
movzx eax, byte [0x1406b0b4a]
test eax, eax
jne 0x140204644
call fcn.1402061b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1406b0b68]
call fcn.1401ffb50
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1402046aa
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x140204691
mov dword [rsp + 0x94], 1
jmp 0x14020469c
mov dword [rsp + 0x94], 0
movzx eax, byte [rsp + 0x94]
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x1402040b6
lea rcx, [rsp + 0x330]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x350]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x370]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x390]
call fcn.14006ca40
mov rcx, qword [rsp + 0x900]
xor rcx, rsp
call fcn.1403d5a60
add rsp, 0x918
pop rdi
pop rsi
ret