Function at 0x140039690
Capabilities:
Capture network configuration via ipconfig
Delete file
Delete volume shadow copies
Execute command
Set console window title
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x11c0
call fcn.140130590
sub rsp, rax
mov rax, qword [0x14018c080]
xor rax, rsp
mov qword [rsp + 0x11b8], rax
lea rcx, [0x140223100]
call fcn.1400d6e80
jmp 0x14003a395
lea rdx, str.____Loading_Menu
lea rcx, [rsp + 0x608]
call fcn.14003b820
mov rcx, rax
call fcn.14003b850
mov rcx, rax
call fcn.1400c9e30
lea rdx, [0x14017b450]
lea rcx, [rsp + 0xdc0]
call fcn.140034b20
mov rcx, rax
call fcn.140034b50
mov qword [rsp + 0x410], rax
lea rdx, [0x14017b478]
lea rcx, [rsp + 0xe98]
call fcn.14003b870
mov rcx, rax
call fcn.14003b8a0
mov qword [rsp + 0x408], rax
lea rdx, [0x14017b4a8]
lea rcx, [rsp + 0x7f0]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov qword [rsp + 0x400], rax
lea rdx, [0x14017b4c8]
lea rcx, [rsp + 0xf28]
call fcn.140032060
mov rcx, rax
call fcn.140032090
mov qword [rsp + 0x428], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x1178]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140031ca0
call fcn.140031be0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0xf0
mov r8d, dword [rsp + 0x117c]
mov edx, dword [rsp + 0x1178]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_MoveWindow]
mov edx, 0x1f4
lea rcx, [rsp + 0x5d0]
call fcn.140031f20
mov qword [rsp + 0x3c8], rax
mov rcx, qword [rsp + 0x3c8]
call fcn.1400439c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rsp + 0x5d0]
call fcn.140043b30
lea rdx, str.X.win_V1_Logs:
lea rcx, [rsp + 0x5c0]
call fcn.14003b910
mov rcx, rax
call fcn.14003b940
mov rcx, rax
call fcn.1400c9e30
call fcn.1400320b0
lea rdx, [0x14017b508]
lea rcx, [rsp + 0x4a0]
call fcn.14003b960
mov rcx, rax
call fcn.14003b990
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x11d0]
call fcn.14002ec30
movzx eax, ax
test eax, eax
jne 0x14003a59b
mov dword [rsp + 0x90], 1
lea rcx, [rsp + 0x1128]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1148]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1108]
call fcn.140043b30
mov eax, dword [rsp + 0x90]
jmp 0x14003b413
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x1168]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x1170]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x1174]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x4b
mov dword [rsp + 0x94], eax
lea rdx, [0x14017b518]
lea rcx, [rsp + 0x4b0]
call fcn.14003b960
mov rcx, rax
call fcn.14003b990
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x11d0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x82
mov dword [rsp + 0x30], 0x82
mov ecx, dword [rsp + 0x94]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x98]
mov dword [rsp + 0x20], ecx
mov r9d, 0x80000000
mov r8, rax
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x14003a6b6
mov dword [rsp + 0x9c], 2
lea rcx, [rsp + 0x1128]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1148]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1108]
call fcn.140043b30
mov eax, dword [rsp + 0x9c]
jmp 0x14003b413
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x14003a6e4
mov rdx, qword [rsp + 0x11d0]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.USER32.dll_UnregisterClassA]
lea rax, [0x140223430]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov dword [0x140223458], 1
mov dword [0x140223448], 1
mov dword [0x140223438], 0
mov dword [0x14022345c], 1
mov dword [0x140223460], 0x50
mov dword [0x14022346c], 1
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x3d0], rax
lea rax, [0x140223428]
mov qword [rsp + 0x30], rax
lea rax, [0x140223430]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9, qword [rsp + 0x80]
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [rsp + 0x3d0]
test eax, eax
jge 0x14003a7f0
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, qword [rsp + 0x11d0]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [rsp + 0xa0], 0
lea rcx, [rsp + 0x1128]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1148]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1108]
call fcn.140043b30
mov eax, dword [rsp + 0xa0]
jmp 0x14003b413
mov rdx, qword [0x140223428]
mov rcx, qword [rsp + 0x80]
call fcn.14002cca0
call fcn.140007920
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
movss xmm0, dword [0x14017e9b8]
movss dword [rax + 0x14], xmm0
lea rax, [rsp + 0x1188]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_50
rep stosb byte [rdi], al
mov edx, 0xa
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [rsp + 0x1190], 0x12
je 0x14003b370
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1188]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14003a8a9
lea rcx, [rsp + 0x1188]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x1188]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14003a85b
call fcn.14002d220
mov dword [rsp + 0xa4], 0x13e
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x14003a8cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movss xmm2, dword [0x14017ea20]
movss xmm1, dword [0x14017ea20]
lea rcx, [rsp + 0x460]
call fcn.140001520
mov qword [rsp + 0x3e0], rax
lea rdx, [0x14017b528]
lea rcx, [rsp + 0x4c0]
call fcn.14003b960
mov rcx, rax
call fcn.14003b990
mov qword [rsp + 0x3e8], rax
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x20], eax
movss xmm3, dword [0x14017e988]
mov r8, qword [rsp + 0x3e0]
lea rdx, reloc.WS2_32.dll_accept
mov rcx, qword [rsp + 0x3e8]
call fcn.14000d510
movss xmm0, dword [0x14017ea48]
call fcn.1400127b0
lea rcx, [rsp + 0x468]
call fcn.140012c10
movss xmm0, dword [rax]
mulss xmm0, dword [0x14017e97c]
xorps xmm2, xmm2
movaps xmm1, xmm0
lea rcx, [rsp + 0x470]
call fcn.140001520
mov qword [rsp + 0x3f0], rax
lea rdx, str.Null_Serials
lea rcx, [rsp + 0x590]
call fcn.14003b9b0
mov rcx, rax
call fcn.14003b9e0
mov qword [rsp + 0x3f8], rax
mov rdx, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x3f8]
call fcn.140013620
movzx eax, al
test eax, eax
je 0x14003ae77
lea rdx, str._n_n___NULLING_SERIALS
lea rcx, [rsp + 0x728]
call fcn.14003ba00
mov rcx, rax
call fcn.14003ba30
mov rcx, rax
call fcn.1400c9e30
call fcn.140031ca0
lea rdx, [0x14017b560]
lea rcx, [rsp + 0x810]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [0x14017b580]
lea rcx, [rsp + 0xec8]
call fcn.14003b870
mov rcx, rax
call fcn.14003b8a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140031ca0
mov rdx, qword [rsp + 0x400]
lea rcx, [rsp + 0x520]
call fcn.140043c30
nop
mov r8d, 0x70600
lea rdx, [0x1401add10]
lea rcx, [rsp + 0x520]
call fcn.1400c9e90
nop
lea rcx, [rsp + 0x520]
call fcn.140043b30
mov rdx, qword [rsp + 0x408]
lea rcx, [rsp + 0x500]
call fcn.140043c30
nop
mov r8d, 0x1800
lea rdx, [0x1401a4110]
lea rcx, [rsp + 0x500]
call fcn.1400c9e90
nop
lea rcx, [rsp + 0x500]
call fcn.140043b30
lea rdx, str.C:UsersDefaultmapper.exe_C:UsersDefaultMusic1337hAxoRSp0oFer.sys__nul_2_1
lea rcx, [rsp + 0x10a0]
call fcn.140032f00
mov rcx, rax
call fcn.140032f30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:UsersDefaultmapper.exe
lea rcx, [rsp + 0x830]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.C:UsersDefaultMusic1337hAxoRSp0oFer.sys
lea rcx, [rsp + 0xef8]
call fcn.14003b870
mov rcx, rax
call fcn.14003b8a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str._n___NULLED_SERIALS
lea rcx, [rsp + 0x6c8]
call fcn.14003ba50
mov rcx, rax
call fcn.14003ba80
mov rcx, rax
call fcn.1400c9e60
lea rdx, str._n_n___Resetting_PhysicalDisk
lea rcx, [rsp + 0x850]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call fcn.1400c9e30
lea rdx, str.powershell.exe__Reset_PhysicalDisk___nul_2_1
lea rcx, [rsp + 0x1018]
call fcn.1400395f0
mov rcx, rax
call fcn.140039620
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
lea rcx, [rsp + 0xfe8]
call fcn.14003baa0
mov rcx, rax
call fcn.14003bad0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n___Successfully_Reset_PhysicalDisk
lea rcx, [rsp + 0xc30]
call fcn.14003baf0
mov rcx, rax
call fcn.14003bb20
mov rcx, rax
call fcn.1400c9e60
lea rdx, str._n_n___Spoofing_Mac
lea rcx, [rsp + 0x668]
call fcn.14003bb40
mov rcx, rax
call fcn.14003bb70
mov rcx, rax
call fcn.1400c9e30
mov rdx, qword [rsp + 0x410]
lea rcx, [rsp + 0x4e0]
call fcn.140043c30
nop
mov r8d, 0x18000
lea rdx, [0x14018c110]
lea rcx, [rsp + 0x4e0]
call fcn.1400c9e90
nop
lea rcx, [rsp + 0x4e0]
call fcn.140043b30
lea rdx, [0x14017b730]
lea rcx, [rsp + 0xde8]
call fcn.140034b20
mov rcx, rax
call fcn.140034b50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:WindowsSystem32gaymacchanger.exe
lea rcx, [rsp + 0xe10]
call fcn.140034b20
mov rcx, rax
call fcn.140034b50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str._n___Spoofed_Mac
lea rcx, [rsp + 0x5f0]
call fcn.14003bb90
mov rcx, rax
call fcn.14003bbc0
mov rcx, rax
call fcn.1400c9e60
lea rdx, str._n_n___Resetting_Network
lea rcx, [rsp + 0x758]
call fcn.14003bbe0
mov rcx, rax
call fcn.14003bc10
mov rcx, rax
call fcn.1400c9e30
lea rdx, [0x14017b7a8]
lea rcx, [rsp + 0x970]
call fcn.14003bc30
mov rcx, rax
call fcn.14003bc60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b7c8]
lea rcx, [rsp + 0x8f0]
call fcn.14003bc80
mov rcx, rax
call fcn.14003bcb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b7e8]
lea rcx, [rsp + 0xcf8]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b810]
lea rcx, [rsp + 0xd20]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b838]
lea rcx, [rsp + 0xc58]
call fcn.14003baf0
mov rcx, rax
call fcn.14003bb20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b860]
lea rcx, [rsp + 0x870]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b880]
lea rcx, [rsp + 0x890]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b8a0]
lea rcx, [rsp + 0x770]
call fcn.14003bcd0
mov rcx, rax
call fcn.14003bd00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b8c0]
lea rcx, [rsp + 0x910]
call fcn.14003bc80
mov rcx, rax
call fcn.14003bcb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017b8e0]
lea rcx, [rsp + 0x790]
call fcn.14003bcd0
mov rcx, rax
call fcn.14003bd00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n___Successfully_Reset_Network
lea rcx, [rsp + 0xb30]
call fcn.14003bd20
mov rcx, rax
call fcn.14003bd50
mov rcx, rax
call fcn.1400c9e60
lea rcx, [rsp + 0x478]
call fcn.140012c10
movss xmm0, dword [rax]
mulss xmm0, dword [0x14017e97c]
xorps xmm2, xmm2
movaps xmm1, xmm0
lea rcx, [rsp + 0x480]
call fcn.140001520
mov qword [rsp + 0x418], rax
lea rdx, str.Clean_Traces
lea rcx, [rsp + 0x5a0]
call fcn.14003b9b0
mov rcx, rax
call fcn.14003b9e0
mov qword [rsp + 0x420], rax
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rsp + 0x420]
call fcn.140013620
movzx eax, al
test eax, eax
je 0x14003b189
lea rdx, str._n_n___Cleaning
lea rcx, [rsp + 0x5b0]
call fcn.14003bd70
mov rcx, rax
call fcn.14003bda0
mov rcx, rax
call fcn.1400c9e30
lea rdx, [0x14017b940]
lea rcx, [rsp + 0xf58]
call fcn.140032060
mov rcx, rax
call fcn.140032090
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x428]
lea rcx, [rsp + 0x540]
call fcn.140043c30
nop
mov r8d, 0x8400
lea rdx, [0x1401a5910]
lea rcx, [rsp + 0x540]
call fcn.1400c9e90
nop
lea rcx, [rsp + 0x540]
call fcn.140043b30
lea rdx, [0x14017b970]
lea rcx, [rsp + 0xf88]
call fcn.140032060
mov rcx, rax
call fcn.140032090
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.C:Windows_system32NotACleaner1337HAx0r.exe
lea rcx, [rsp + 0xfb8]
call fcn.140032060
mov rcx, rax
call fcn.140032090
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call fcn.1400342b0
call fcn.140032130
call fcn.140034330
call fcn.140034400
call fcn.140034f30
call fcn.140035470
call fcn.1400359b0
call fcn.140035ef0
lea rdx, str.NETSH_WINSOCK_RESET__nul_2_1
lea rcx, [rsp + 0x990]
call fcn.14003bc30
mov rcx, rax
call fcn.14003bc60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.NETSH_INT_IP_RESET__nul_2_1
lea rcx, [rsp + 0x930]
call fcn.14003bc80
mov rcx, rax
call fcn.14003bcb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.NETSH_INTERFACE_IPV4_RESET__nul_2_1
lea rcx, [rsp + 0xd48]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.NETSH_INTERFACE_IPV6_RESET__nul_2_1
lea rcx, [rsp + 0xd70]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.NETSH_INTERFACE_TCP_RESET__nul_2_1
lea rcx, [rsp + 0xc80]
call fcn.14003baf0
mov rcx, rax
call fcn.14003bb20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017ba88]
lea rcx, [rsp + 0x8d0]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.IPCONFIG__RELEASE__nul_2_1
lea rcx, [rsp + 0x8b0]
call fcn.14003b8c0
mov rcx, rax
call fcn.14003b8f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14017bac8]
lea rcx, [rsp + 0x7b0]
call fcn.14003bcd0
mov rcx, rax
call fcn.14003bd00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.IPCONFIG__FLUSHDNS__nul_2_1
lea rcx, [rsp + 0x950]
call fcn.14003bc80
mov rcx, rax
call fcn.14003bcb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.IPCONFIG__RENEW__nul_2_1
lea rcx, [rsp + 0x7d0]
call fcn.14003bcd0
mov rcx, rax
call fcn.14003bd00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n___Cleaned
lea rcx, [rsp + 0x580]
call fcn.14003bdc0
mov rcx, rax
call fcn.14003bdf0
mov rcx, rax
call fcn.1400c9e60
lea rcx, [rsp + 0x488]
call fcn.140012c10
movss xmm0, dword [rax]
mulss xmm0, dword [0x14017e97c]
xorps xmm2, xmm2
movaps xmm1, xmm0
lea rcx, [rsp + 0x458]
call fcn.140001520
mov qword [rsp + 0x430], rax
lea rdx, str.Discord
lea rcx, [rsp + 0x490]
call fcn.14003be10
mov rcx, rax
call fcn.14003be40
mov qword [rsp + 0x438], rax
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x438]
call fcn.140013620
movzx eax, al
test eax, eax
je 0x14003b26a
lea rdx, str._n_n___Loading_Discord
lea rcx, [rsp + 0x740]
call fcn.14003ba00
mov rcx, rax
call fcn.14003ba30
mov rcx, rax
call fcn.1400c9e30
lea rdx, str.start_https:__discord.gg_bmZZRjsa8n
lea rcx, [rsp + 0xd98]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n___Loaded_Discord
lea rcx, [rsp + 0x6e0]
call fcn.14003ba50
mov rcx, rax
call fcn.14003ba80
mov rcx, rax
call fcn.1400c9e60
call fcn.140011890
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x440], rax
xor r8d, r8d
mov edx, 7
mov rcx, qword [0x140223428]
call qword [rsp + 0x440]
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x448], rax
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov rcx, qword [0x140223428]
call qword [rsp + 0x448]
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x450], rax
xor r8d, r8d
mov edx, 0xae
mov rcx, qword [0x140223428]
call qword [rsp + 0x450]
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rcx, qword [0x140223428]
call qword [rax + 0x148]
test eax, eax
jl 0x14003b333
call fcn.14000a410
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rcx, qword [0x140223428]
call qword [rax + 0x150]
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140223428]
call qword [rsp + 0xb8]
jmp 0x14003a85b
call fcn.14002ced0
cmp qword [0x140223428], 0
je 0x14003b393
mov rax, qword [0x140223428]
mov rax, qword [rax]
mov rcx, qword [0x140223428]
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x78], 0
je 0x14003b3ab
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
lea rdx, str.X.win_V1
lea rcx, [rsp + 0x4d0]
call fcn.14003b960
mov rcx, rax
call fcn.14003b990
mov rdx, qword [rsp + 0x11d0]
mov rcx, rax
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [rsp + 0xa8], 0
lea rcx, [rsp + 0x1128]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1148]
call fcn.140043b30
nop
lea rcx, [rsp + 0x1108]
call fcn.140043b30
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x11b8]
xor rcx, rsp
call fcn.14012fc50
add rsp, 0x11c0
pop rdi
ret