Function at 0x140078c00
Capabilities:
Create thread
Encode data using xor
Execute command
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14012d9c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor r13d, r13d
lea edx, [r13 + 1]
lea rcx, [0x14006ae10]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Go_Premium_Proxy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov byte [rsp + 0x30], r13b
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
lea rcx, [0x1401322b0]
call fcn.14008f1e0
cmp byte [0x1401324c8], r13b
jne 0x140078d0a
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400693a0
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x140078cd8
xor byte [rax], 0x30
xor byte [rax + 1], 0x31
xor byte [rax + 2], 0x32
xor byte [rax + 3], 0x33
xor byte [rax + 4], 0x34
xor byte [rax + 5], 0x35
xor byte [rax + 6], 0x36
xor byte [rax + 7], 0x37
xor byte [rax + 8], 0x38
xor byte [rax + 9], 0x39
xor cl, 0x3a
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
mov rcx, rax
lea rdx, [0x1401324d0]
call fcn.14000cb40
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1401322b0]
call fcn.14008c5d0
test al, al
je 0x140078d21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rcx, [0x1400fedbc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400f5920]
movdqu xmmword [rbp + 0x40], xmm1
mov byte [rbp + 0x30], r13b
movups xmm0, xmmword [0x1400fed70]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1400fed80]
movsd qword [rsp + 0x50], xmm0
cmp byte [0x1400fed87], 0
je 0x140078ef0
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140078eaf
movdqa xmm5, xmmword [0x1400ff5a0]
mov edx, r13d
movdqa xmm4, xmmword [0x1400ff5e0]
movdqa xmm6, xmmword [str.6666]
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rsp + 0x44]
mov r8d, dword [rbp - 0x30]
nop dword [rax + rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ff5c0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400ff5c0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x18
jl 0x140078db0
jmp 0x140078ef0
lea r9, [rsp + 0x40]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x18
jl 0x140078ec0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140063820
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x30]
call fcn.14001a1d0
mov rdx, rax
lea rcx, [0x1401322b0]
call fcn.1400907d0
cmp byte [0x1401324c8], 0
jne 0x140078fac
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14006a540
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x140078f7a
xor byte [rax], 0x30
xor byte [rax + 1], 0x31
xor byte [rax + 2], 0x32
xor byte [rax + 3], 0x33
xor byte [rax + 4], 0x34
xor byte [rax + 5], 0x35
xor byte [rax + 6], 0x36
xor byte [rax + 7], 0x37
xor byte [rax + 8], 0x38
xor byte [rax + 9], 0x39
xor cl, 0x3a
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
mov rcx, rax
lea rdx, [0x1401324d0]
call fcn.14000cb40
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [0x140132490]
mov rdi, qword [0x140132498]
cmp rbx, rdi
je 0x14007901d
nop
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14001a1d0
lea rcx, [0x1400fedbc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140079014
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007900f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079658
call fcn.1400e3d54
add rbx, 0x20
cmp rbx, rdi
jne 0x140078fc0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
xor r8d, r8d
lea rdx, [0x1400f5955]
lea rcx, [rbp]
call fcn.14000e040
nop
mov r15, qword [0x140132490]
mov r12, qword [0x140132498]
cmp r15, r12
je 0x1400791de
mov edx, reloc.WS2_32.dll_shutdown
movabs rcx, 0x8000000000000000
movabs rax, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14007908c
mov rdi, qword [r15]
mov r14, qword [r15 + 0x10]
cmp r14, rax
ja 0x140079701
cmp r14, 0xf
ja 0x1400790bd
mov qword [rbp - 0x20], r14
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x30], xmm0
movq rbx, xmm0
jmp 0x140079149
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x1400790da
mov rsi, rax
lea rax, [rcx + 0x27]
jmp 0x1400790fc
cmp rsi, 0x16
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14007911b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400796fb
mov rcx, rax
call fcn.1400e3d18
test rax, rax
je 0x1400791d7
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14007912d
test rcx, rcx
je 0x14007912a
call fcn.1400e3d18
mov rbx, rax
jmp 0x14007912d
mov rbx, r13
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rsi
lea r8, [r14 + 1]
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
nop
lea r9, [rbp - 0x30]
cmp rsi, 0xf
cmova r9, rbx
mov rax, qword [rbp + 0x18]
cmp r14, rax
ja 0x140079184
lea rdi, [rbp]
cmp rax, 0xf
cmova rdi, qword [rbp]
mov qword [rbp + 0x10], r14
mov r8, r14
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + r14], 0
jmp 0x14007919b
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp]
call fcn.140011d50
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x30]
cmp rsi, 0xf
jbe 0x1400791ce
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400791c6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400791d7
mov rcx, rbx
call fcn.1400e3d54
add r15, 0x20
jmp 0x14007904e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp]
mov rbx, qword [rbp]
mov rdi, qword [rbp + 0x18]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp + 0x10]
cmp r8, 4
jne 0x140079298
lea rdx, [0x1400fedc0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140079298
mov byte [0x14013121c], al
lea ecx, [rax + 8]
call fcn.1400e3d18
test rax, rax
je 0x140079233
lea rcx, [fcn.1400454d0]
mov qword [rax], rcx
jmp 0x140079236
mov rax, r13
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140064a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140079712
cmp dword [rbp - 0x28], 0
je 0x140079707
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140079707
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov edx, 0xa
lea rcx, str.Go_Premium_Proxy_n
call fcn.1400637f0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rbp + 0x50]
lea rcx, str.1186381965415436428
call fcn.14007f020
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
lea rax, str.Plan:_Premium_User
mov qword [rsp + 0x68], rax
lea rsi, str.Go_Proxy
mov qword [rsp + 0x60], rsi
call sub.MSVCP140.dll__Xtime_get_ticks
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r13
lea rax, str.gostorelogo
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rsi
lea rax, str.verifed
mov qword [rbp - 0x70], rax
lea rax, str.Currently_In_Game
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x60]
call fcn.14007f3b0
call fcn.140075c40
mov ecx, 8
call fcn.1400e3d18
test rax, rax
je 0x140079366
lea rcx, [0x140076b90]
mov qword [rax], rcx
jmp 0x140079369
mov rax, r13
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140064a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400796ec
mov ecx, 8
call fcn.1400e3d18
test rax, rax
je 0x1400793b8
lea rcx, [0x14006acc0]
mov qword [rax], rcx
jmp 0x1400793bb
mov rax, r13
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140064a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400796dd
cmp dword [rbp - 0x28], 0
je 0x140079755
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140079755
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
lea ecx, [rax + 8]
call fcn.1400e3d18
test rax, rax
je 0x140079436
lea rcx, [0x14006f740]
mov qword [rax], rcx
jmp 0x140079439
mov rax, r13
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140064a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140079746
mov ecx, 8
call fcn.1400e3d18
test rax, rax
je 0x140079488
lea rcx, [0x14006b1c0]
mov qword [rax], rcx
jmp 0x14007948b
mov rax, r13
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140064a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140079737
cmp dword [rbp - 0x28], 0
je 0x14007972c
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14007972c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
call fcn.1400702d0
cmp byte [0x140131e09], 0
jne 0x140079523
mov edx, 4
lea rcx, str.Failed_to_edit_Hosts_File_n
call fcn.1400637f0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140030930
cmp dword [rbp - 8], 0
je 0x140079721
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140079721
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
call fcn.14000c350
mov rcx, qword [0x1401320e8]
call fcn.14007c880
mov rcx, qword [0x1401320e8]
call fcn.14007c760
test al, al
je 0x140079601
lea rcx, str.Color_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Color_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Main_Settings_Loaded_n
call fcn.140061c20
lea rdx, str.Server__client_proxy_is_running._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
lea rdx, str.You_can_now_connect_to_Growtopia_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000cda0
mov edx, reloc.WS2_32.dll_ntohl
lea rcx, str.If_Proxy_doesnt_connect_restart_Growtopia_n
call fcn.1400637f0
nop word [rax + rax]
mov rcx, qword [0x1401320e8]
call fcn.14007bb80
mov qword [rsp + 0x40], 5
lea rcx, [rsp + 0x40]
call fcn.140018df0
jmp 0x1400795e0
mov edx, 4
lea rcx, str.Failed_to_start_server_or_proxy._n
call fcn.1400637f0
nop
cmp dword [rbp + 0x28], 0
je 0x140079620
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rbp - 8], 0
je 0x14007962d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp rdi, 0xf
jbe 0x140079668
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007965f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007965f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400e3d54
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400796a6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400796a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400796a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e3d54
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400e3e70
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x28], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 8], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140003ed0
int3
call fcn.140003ef0
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x28], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x28], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp + 0x28], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3