Function at 0x14009bbc0
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Get graphical window text
Open clipboard
Read clipboard data
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x1403705b0]
xor rax, rsp
mov qword [rbp + 0x140], rax
lea rcx, [0x14037c600]
call fcn.140095700
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.140266308
mov r9, rax
lea r8, [0x14033f800]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x50]
call fcn.14026dfd4
xor ecx, ecx
call fcn.140266308
mov r9, rax
lea r8, [0x14033f800]
lea rdx, str.CONIN_
lea rcx, [rbp - 0x50]
call fcn.14026dfd4
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14009cf97
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14009cf97
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14009cf97
xor r14d, r14d
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x30], r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14009bcb0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140066070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
cmp byte [0x14033eeff], r14b
mov esi, 5
movups xmm0, xmmword [rbp - 0x40]
mov eax, dword [str.VZD8]
movups xmm1, xmmword [rbp - 0x30]
mov edi, dword [reloc.WS2_32.dll_accept]
lea r15d, [rsi + 0x1a]
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x48], eax
movups xmmword [rbp - 0x10], xmm1
je 0x14009bdda
mov r8d, r14d
cmp edi, 2
jl 0x14009bd9f
movdqa xmm3, xmmword [0x140341ab0]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1403420a0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1403420a0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, esi
psrad xmm2, xmm0
movd xmm0, r15d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x140341ad0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rbp - 0x48], xmm2
jmp 0x14009bdda
lea r9, [rbp - 0x48]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x14009bdb0
mov qword [rbp - 0x40], r14
lea rax, [rbp - 0x48]
mov qword [rbp - 0x30], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r14b
jne 0x14009bdf5
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x40]
call fcn.140066070
cmp qword [rbp - 0x28], 0x10
lea rcx, [rbp - 0x40]
cmovae rcx, qword [rbp - 0x40]
call fcn.14026dad4
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14009be5a
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009be55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r15
jbe 0x14009be55
call fcn.140264c90
int3
call fcn.140251840
movups xmm0, xmmword [0x14033f2f0]
mov r8d, r14d
movups xmm1, xmmword [0x14033f300]
movzx eax, byte [0x14033f338]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x14033f310]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14033f330]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x14033f320]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x78], al
cmp edi, 2
jl 0x14009c001
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rsp + 0x30]
movdqa xmm5, xmmword [0x140341ab0]
movdqa xmm4, xmmword [0x1403420a0]
movdqa xmm7, xmmword [0x140341ad0]
movdqa xmmword [rbp - 0x40], xmm0
mov edx, dword [rbp - 0x40]
movd xmm6, esi
movd xmm8, r15d
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x48
jl 0x14009bef0
cmp r8d, 0x49
jge 0x14009c044
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x49
jl 0x14009c010
mov qword [rbp - 0x40], r14
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r14b
jne 0x14009c060
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140066070
cmp qword [rbp - 0x28], 0x10
lea rbx, [rbp - 0x40]
lea rcx, [0x14037a010]
cmovae rbx, qword [rbp - 0x40]
call fcn.14009b6a0
test al, al
je 0x14009c0a6
mov edx, 2
lea rcx, [0x14037a010]
call fcn.14009b790
mov rdx, rbx
lea rcx, [0x14037a010]
call fcn.1400a0200
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14009c0f1
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c0ec
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r15
jbe 0x14009c0ec
call fcn.140264c90
int3
call fcn.140251840
movups xmm0, xmmword [0x14033e600]
mov r8d, r14d
movups xmm1, xmmword [0x14033e610]
movzx eax, byte [reloc.WS2_32.dll_gethostname]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x14033e620]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x14033e630]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x14033e640]
movups xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [0x14033e650]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x14033e660]
movups xmmword [rbp - 0x80], xmm1
movsd xmm1, qword [0x14033e670]
movups xmmword [rbp - 0x70], xmm0
movsd qword [rbp - 0x60], xmm1
mov byte [rbp - 0x58], al
cmp edi, 2
jl 0x14009c2b1
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rsp + 0x30]
movdqa xmm5, xmmword [0x140341ab0]
movdqa xmm4, xmmword [0x1403420a0]
movdqa xmm7, xmmword [0x140341ad0]
movdqa xmmword [rbp - 0x40], xmm0
mov edx, dword [rbp - 0x40]
movd xmm6, esi
movd xmm8, r15d
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x78
jl 0x14009c1a0
cmp r8d, 0x79
jge 0x14009c2f4
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x79
jl 0x14009c2c0
mov qword [rbp - 0x40], r14
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r14b
jne 0x14009c310
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140066070
cmp qword [rbp - 0x28], 0x10
lea rbx, [rbp - 0x40]
lea rcx, [0x14037a010]
cmovae rbx, qword [rbp - 0x40]
call fcn.14009b6a0
test al, al
je 0x14009c356
mov edx, 4
lea rcx, [0x14037a010]
call fcn.14009b790
mov rdx, rbx
lea rcx, [0x14037a010]
call fcn.1400a0200
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14009c3a1
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c39c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r15
jbe 0x14009c39c
call fcn.140264c90
int3
call fcn.140251840
mov eax, dword [0x14033e5e8]
mov r8d, r14d
mov dword [rsp + 0x68], eax
movzx eax, word [0x14033e5ec]
mov word [rsp + 0x6c], ax
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x6e], al
movups xmm0, xmmword [0x14033e5b0]
movups xmm1, xmmword [0x14033e5c0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x14033e5d0]
movups xmmword [rsp + 0x40], xmm1
movsd xmm1, qword [0x14033e5e0]
movsd qword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x50], xmm0
cmp edi, 2
jl 0x14009c551
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rsp + 0x30]
movdqa xmm5, xmmword [0x140341ab0]
movdqa xmm4, xmmword [0x1403420a0]
movdqa xmm7, xmmword [0x140341ad0]
movdqa xmmword [rbp - 0x40], xmm0
mov edx, dword [rbp - 0x40]
movd xmm6, esi
movd xmm8, r15d
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140341b30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x38
jl 0x14009c440
cmp r8d, 0x3f
jge 0x14009c594
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x3f
jl 0x14009c560
mov qword [rbp - 0x40], r14
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r14b
jne 0x14009c5b0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140066070
cmp qword [rbp - 0x28], 0x10
lea rbx, [rbp - 0x40]
lea rcx, [0x14037a010]
cmovae rbx, qword [rbp - 0x40]
call fcn.14009b6a0
test al, al
je 0x14009c5f6
mov edx, 6
lea rcx, [0x14037a010]
call fcn.14009b790
mov rdx, rbx
lea rcx, [0x14037a010]
call fcn.1400a0200
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14009c641
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c63c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r15
jbe 0x14009c63c
call fcn.140264c90
int3
call fcn.140251840
lea rdx, [rbp - 0x20]
lea rcx, [0x14037a360]
call fcn.1400a9500
lea rdx, [0x14033f818]
lea rcx, [0x14037a010]
call fcn.1400a0200
mov eax, dword [str.EWBK:]
mov r8, 0xffffffffffffffff
mov dword [rbp - 0x48], eax
movzx eax, word [0x14033f388]
xor byte [rbp - 0x47], 0x36
xor byte [rbp - 0x46], 0x37
xor byte [rbp - 0x45], 0x38
mov word [rbp - 0x44], ax
lea rax, [rbp - 0x48]
xor byte [rbp - 0x44], 0x39
xor byte [rbp - 0x43], 0x3a
mov byte [rbp - 0x48], reloc.WS2_32.dll_WSASetLastError
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14009c6b0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x40]
call fcn.140066070
cmp qword [rbp - 0x28], 0x10
lea rcx, [rbp - 0x40]
cmovae rcx, qword [rbp - 0x40]
call fcn.14026dad4
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14009c715
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009c710
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r15
jbe 0x14009c710
call fcn.140264c90
int3
call fcn.140251840
mov r8d, 7
mov qword [rsp + 0x30], r14
lea rdx, str.default
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
call fcn.140066070
cmp qword [rbp - 8], 0x10
lea rsi, [rbp - 0x20]
mov rdi, qword [rbp - 0x10]
cmovae rsi, qword [rbp - 0x20]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
cmp rdi, 0x10
jae 0x14009c774
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
movups xmmword [rbp - 0x40], xmm0
jmp 0x14009c7f2
movabs rax, 0x7fffffffffffffff
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14009c7cc
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x14009c7a8
call fcn.14005c980
int3
mov rcx, rax
call fcn.140251848
mov rcx, rax
test rax, rax
je 0x14009c7c6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14009c7db
call fcn.140264c90
int3
test rcx, rcx
je 0x14009c7d8
call fcn.140251848
jmp 0x14009c7db
mov rax, r14
lea r8, [rdi + 1]
mov qword [rbp - 0x40], rax
mov rdx, rsi
mov rcx, rax
call fcn.140254100
mov qword [rbp - 0x28], rbx
lea r8, [rsp + 0x30]
mov qword [rbp - 0x30], rdi
lea rdx, [rbp - 0x40]
lea rcx, [0x14037c600]
call fcn.1400986b0
test al, al
je 0x14009cf97
mov r8d, 0xa
mov qword [rbp - 0x20], r14
cmp qword [0x14037c6b0], r8
lea rdx, [0x14037c6a0]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], r14
cmovb r8, qword [0x14037c6b0]
cmp qword [0x14037c6b8], 0x10
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
cmovae rdx, qword [0x14037c6a0]
call fcn.140066070
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x14009c898
mov rcx, qword [0x140371800]
inc rdx
cmp rdx, 0x1000
jb 0x14009c893
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, r15
ja 0x14009cc13
mov rcx, r8
call fcn.140251840
movups xmm0, xmmword [rbp - 0x20]
lea rcx, [0x14033f81c]
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [0x140371800], xmm0
movups xmmword [0x140371810], xmm1
call fcn.14026dad4
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c8db
mov edx, 2
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.___________________________________________________Welcome_To_Legion_Vip_Hack__n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c90f
mov edx, 4
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.________________________________________________________________________________________________________________________n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c943
mov edx, 2
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.Select_Emulator__n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c977
mov edx, 6
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.1___GameLoop_7.1__n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c9ab
mov edx, 6
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.2___GameLoop_4.4__n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, [0x14037a010]
call fcn.14009b6a0
test al, al
je 0x14009c9df
mov edx, 6
lea rcx, [0x14037a010]
call fcn.14009b790
lea rdx, str.3___SmartGaga__n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x48], r14d
call fcn.1400a13b0
mov ebx, dword [rbp - 0x48]
lea eax, [rbx - 1]
cmp eax, 2
ja 0x14009ca1d
lea rdx, str._n_n_n_n
lea rcx, [0x14037a010]
call fcn.1400a0200
lea rcx, str.pause
call fcn.14026dad4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x14009bba0]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.TitanRenderWindowClass
mov dword [0x14037c168], 3
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_FindWindowW]
lea r9, str.SmartGaGa_RenderWindow
xor edx, edx
mov rcx, rax
lea r8, str.TitanRenderWindowClass
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14037c028]
je 0x14009caba
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14037c028]
jne 0x14009caa0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp ebx, 1
jne 0x14009cc19
mov dword [0x14037c168], ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x40], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14009cb10
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.140066070
lea rdx, str.Turbo_AOW_Engine
lea rcx, [rbp - 0x40]
call fcn.14006c080
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea r8, str.AEngineRenderWindowClass
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
cmp rbx, 0xffffffffffffffff
jne 0x14009cc05
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x40]
call fcn.14005d5c0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x40], r14
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14009cbb0
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.140066070
lea rdx, str.Turbo_AOW_Engine
lea rcx, [rbp - 0x40]
call fcn.14006c080
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea r8, str.AEngineRenderWindowClass
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
cmp rbx, 0xffffffffffffffff
je 0x14009cb65
lea rcx, [rbp - 0x40]
call fcn.14005d5c0
jmp 0x14009cd3a
call fcn.140264c90
int3
cmp ebx, 2
jne 0x14009ccd3
lea rcx, [rbp - 0x20]
mov dword [0x14037c168], ebx
call fcn.14009b8d0
lea rdx, str.Turbo_AOW_Engine
lea rcx, [rbp - 0x20]
call fcn.14006c080
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea r8, str.AEngineRenderWindowClass
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
cmp rbx, 0xffffffffffffffff
jne 0x14009ccc8
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x20]
call fcn.14005d5c0
lea rcx, [rbp - 0x20]
call fcn.14009b8d0
lea rdx, str.Turbo_AOW_Engine
lea rcx, [rbp - 0x20]
call fcn.14006c080
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea r8, str.AEngineRenderWindowClass
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
cmp rbx, 0xffffffffffffffff
je 0x14009cc70
lea rcx, [rbp - 0x20]
call fcn.14005d5c0
jmp 0x14009cd3a
cmp ebx, 3
jne 0x14009cd3a
lea rdx, str.TitanRenderWindowClass
mov dword [0x14037c168], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
lea r9, str.SmartGaGa_RenderWindow
xor edx, edx
mov rcx, rax
lea r8, str.TitanRenderWindowClass
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [0x14037c028], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14037c028]
je 0x14009cd3a
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14037c028]
jne 0x14009cd20
mov ecx, 0x88
call fcn.140251848
mov rcx, rax
mov rbx, rax
call fcn.14009cfa0
lea rdx, str.Xtreme
lea rcx, [rbp - 0x40]
call fcn.140064e00
lea rdx, str.DeviceXtreme
lea rcx, [rbp - 0x20]
call fcn.140064e00
lea rdx, str.Xtreme.sys
lea rcx, [rsp + 0x30]
call fcn.140064e00
lea r9, [rbp - 0x40]
mov rcx, rbx
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x30]
call fcn.14008f9c0
lea rcx, [rsp + 0x30]
call fcn.14005d5c0
lea rcx, [rbp - 0x20]
call fcn.14005d5c0
lea rcx, [rbp - 0x40]
call fcn.14005d5c0
mov rcx, qword [0x14037c028]
lea rdx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call fcn.140266308
mov rcx, rax
call fcn.1402667b0
mov edx, dword [0x14037c168]
call fcn.14009e930
mov rcx, rax
call fcn.140067610
call fcn.1400b0f90
mov edx, eax
call fcn.14009e930
mov rcx, rax
call fcn.140067610
call fcn.1400b1090
mov rdx, rax
mov qword [0x14037bfa8], rax
call fcn.140064b90
mov rcx, rax
call fcn.140067610
call fcn.14006b490
mov dword [0x14037c0f8], eax
call fcn.14006ba10
mov edx, eax
mov dword [0x14037c194], eax
lea rcx, [0x14037a010]
call fcn.14009e730
mov rcx, rax
call fcn.140067610
mov eax, dword [0x14037c0f8]
test eax, eax
je 0x14009cf75
lea edx, [rax - 0x46cf44]
add eax, 0xffb89928
lea rcx, [0x14037a010]
mov dword [0x14037c0f4], eax
mov dword [0x14037c0fc], edx
call fcn.14009e730
mov rcx, rax
call fcn.140067610
mov edx, dword [0x14037c0f4]
mov rcx, rax
call fcn.14009e730
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140064480]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140069700]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140069d30]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x14006be70]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14009cf62
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rbp + 8], 0x12
je 0x14009cf97
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14009cf30
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Driver_Not_Loaded
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call fcn.140260c14
int3