Function at 0x14017ae60
Capabilities:
Create process on windows
Create process suspended
Create thread
Delete file
Execute command
Inject dll
Inject thread
Query environment variable
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.140181fa0
sub rsp, rax
mov rax, qword [0x140189010]
xor rax, rsp
mov qword [rbp + 0x12e0], rax
xor r13d, r13d
mov dword [rbp - 8], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
lea r8d, [r13 + 0x31]
lea rdx, str.curl_https:__gitee.com_idan66_dm_blob_master_yanz
lea rcx, [rbp + 0xc0]
call fcn.14017f3c0
nop
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
lea rdx, [0x140183a90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
xor r8d, r8d
lea rdx, [0x1401838b9]
lea rcx, [rbp + 0xa0]
call fcn.14017f3c0
nop
lea rdi, [r13 - 1]
test rbx, rbx
je 0x14017afb7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x14017afae
nop dword [rax + rax]
mov r8, rbx
mov edx, 0x1000
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14017afa1
lea rax, [rbp + 0x2e0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14017af84
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0xa0]
call fcn.14017e1d0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x14017af60
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
lea rcx, [0x140183acc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rsi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rsi, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xb0]
cmp rax, 0xc
jb 0x14017b048
lea r14, [rax + rsi]
lea r8, [r14 - 0xb]
sub r8, rsi
mov edx, 0x73
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14017b048
nop dword [rax + rax]
mov r8d, 0xc
lea rdx, str.sbslowlywcnm
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14017b064
inc rbx
lea r8, [r14 - 0xb]
sub r8, rbx
mov edx, 0x73
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14017b010
lea rdx, [0x140183ae0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
sub rbx, rsi
cmp rbx, rdi
je 0x14017b048
lea rcx, str.RELAX_2K23_10.29
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.http:__qm.qq.com_cgi_bin_qm_qr__wv1027kNUWLCLz6GT4wNRA_TTsoFVe7XykSXHrUauthKeyLwpzV7U9oMdRWHG3BtmyyTvB_2B2tX4SIOnWkDLhnNqz86_2Bbw_2B8J_2FQ3w5aNFdMgGjrnoverify0group_code924316603
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 1
lea rcx, [0x14017abb0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x14017b1b5
lea rdx, [0x140183bd8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14017b121
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b11c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b11c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
mov qword [rbp + 0xb0], r13
mov r14d, 0xf
mov qword [rbp + 0xb8], r14
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14017b180
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b17b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b17b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
mov eax, 1
mov rcx, qword [rbp + 0x12e0]
xor rcx, rsp
call fcn.140181140
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.______________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140183c70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, rax
lea rdx, [0x140183c20]
call fcn.14017e700
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140183cf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, rax
lea rdx, str.___titan
call fcn.14017e700
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, rax
lea rdx, str.
call fcn.14017e700
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._____________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, rax
lea rdx, str.___BadLife_Network
call fcn.14017e700
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0x50], r13
movdqu xmmword [rbp + 0x70], xmm1
mov qword [rbp + 0x80], r13
call fcn.1401809ec
lea r14, [0x140183e20]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xa
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1401794c0
nop
call fcn.1401809ec
lea rcx, str.Desktop
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 7
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.1401794c0
nop
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x14017b314
call fcn.1401809ec
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.1401794c0
mov dword [rbp - 8], 0x1f8000
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.14017d810
mov dword [rbp - 8], 0x3f8000
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140179710
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp]
call fcn.14017d810
mov dword [rbp - 8], 0x7f8000
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140179710
mov rdx, qword [rbp + 0x48]
cmp rdx, qword [rbp + 0x50]
je 0x14017b3c7
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
movups xmm0, xmmword [rbp]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rdx + 0x10], xmm1
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
add qword [rbp + 0x48], 0x20
jmp 0x14017b3d5
lea r8, [rbp]
lea rcx, [rbp + 0x40]
call fcn.1401806a0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14017b418
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b413
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14017b46d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14017b4c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b4bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b4bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14017b517
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b512
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14017b56e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b569
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b569
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
call fcn.1401809ec
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xa
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1401794c0
nop
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x14017b5a6
call fcn.1401809ec
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp + 0x20]
call fcn.1401794c0
mov dword [rbp - 8], 0x79f8000
lea rdx, [rbp + 0x20]
lea rcx, [rbp]
call fcn.14017d810
mov dword [rbp - 8], 0xf9f8000
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140179710
mov rdx, qword [rbp + 0x48]
cmp rdx, qword [rbp + 0x50]
je 0x14017b637
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
movups xmm0, xmmword [rbp]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rdx + 0x10], xmm1
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
add qword [rbp + 0x48], 0x20
jmp 0x14017b645
lea r8, [rbp]
lea rcx, [rbp + 0x40]
call fcn.1401806a0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14017b688
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b683
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14017b6dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b6d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b6d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14017b734
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b72f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b72f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
call fcn.1401809ec
lea rcx, str.minecraft
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 9
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1401794c0
nop
call fcn.1401809ec
lea rcx, str.Minecraft
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 9
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.1401794c0
nop
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rbx, rdi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14017b7a0
call fcn.1401809ec
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.1401794c0
mov ebx, 0xf79f9800
mov dword [rbp - 8], ebx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.14017d810
mov dword [rbp - 8], 0xf79fb800
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140179710
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp]
call fcn.14017d810
mov dword [rbp - 8], 0xf79ff800
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140179710
mov rdx, qword [rbp + 0x48]
cmp rdx, qword [rbp + 0x50]
je 0x14017b854
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
movups xmm0, xmmword [rbp]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rdx + 0x10], xmm1
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
add qword [rbp + 0x48], 0x20
jmp 0x14017b862
lea r8, [rbp]
lea rcx, [rbp + 0x40]
call fcn.1401806a0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14017b8a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b8a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b8a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14017b8fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b8f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b8f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14017b94f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b94a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b94a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14017b9a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b99f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b99f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14017b9fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b9f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017b9f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0xd
lea rdx, str.minecraft.ini
lea rcx, [rbp + 0x20]
call fcn.14017f3c0
nop
lea rcx, [rbp + 0x20]
call fcn.14017a6c0
movzx esi, al
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14017ba6b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017ba66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017ba66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
test sil, sil
jne 0x14017bd9c
lea rdx, str.0._
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r15d, 1
mov dword [rbp - 8], r15d
mov rsi, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
lea r14d, [r15 + 0xe]
cmp rsi, r12
je 0x14017bc03
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.14017a260
movsd xmm0, qword [rax]
movsd qword [rbp + 0x90], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x50], ecx
lea rax, [0x140189048]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp], xmm0
mov eax, dword [rbp + 0x90]
test eax, eax
je 0x14017bbeb
cmp eax, 1
je 0x14017bbf3
mov edx, r15d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140183ea0]
call fcn.14017e700
mov rcx, rax
mov rdx, rsi
call fcn.14017e910
mov rcx, rax
lea rdx, [0x140183e9c]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp]
mov rcx, rsi
call fcn.14017e530
bts ebx, 0xa
mov rdx, qword [rbp + 0x78]
cmp rdx, qword [rbp + 0x80]
je 0x14017bb9b
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
movups xmm0, xmmword [rbp]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x10], r13
mov rdx, r14
mov qword [rbp + 0x18], rdx
mov byte [rbp], 0
add qword [rbp + 0x78], 0x20
jmp 0x14017bbac
lea r8, [rbp]
lea rcx, [rbp + 0x70]
call fcn.140180410
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14017bbdf
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017bbda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017bbfc
call fcn.1401813ec
inc r15d
add rsi, 0x20
jmp 0x14017baad
test ecx, ecx
jne 0x14017c8e5
add rsi, 0x20
jmp 0x14017baad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x14017e8d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140183ec8]
call fcn.14017e700
lea edx, [r15 - 1]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140183ea8]
call fcn.14017e700
lea rdx, [rbp - 8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea r15, [0x140189b28]
mov eax, dword [rbp - 8]
cmp eax, 1
jne 0x14017bc68
mov rdx, qword [rbp + 0x70]
jmp 0x14017bc95
test eax, eax
jne 0x14017bc8d
lea rdx, [0x140183ed0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14017ea90
jmp 0x14017bcad
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe0
cmp r15, rdx
je 0x14017bcad
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x14017bca8
mov rdx, qword [rdx]
call fcn.14017e040
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x120]
call fcn.140181e64
mov r8d, 2
lea rdx, str.minecraft.ini
lea rcx, [rbp + 0x120]
call fcn.14017d620
nop
cmp qword [rbp + 0x1a8], 0
je 0x14017bd3f
mov rdx, r15
cmp qword [0x140189b40], 0x10
cmovae rdx, qword [0x140189b28]
mov r8, qword [0x140189b38]
lea rcx, [rbp + 0x120]
call fcn.14017fe10
lea rcx, [rbp + 0x128]
call fcn.14017ddb0
test rax, rax
jne 0x14017bd3f
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call fcn.14017d5b0
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14017be6d
lea rcx, [rsp + 0x60]
call fcn.14017abe0
mov rsi, rax
lea r15, [0x140189b28]
mov r14d, 0xf
cmp r15, rax
je 0x14017be2d
mov rdx, qword [0x140189b40]
cmp rdx, 0x10
jb 0x14017bdf8
mov rcx, qword [0x140189b28]
inc rdx
cmp rdx, 0x1000
jb 0x14017bdf3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017be61
mov rcx, r8
call fcn.1401813ec
mov qword [0x140189b38], r13
mov qword [0x140189b40], r14
mov byte [0x140189b28], 0
movups xmm0, xmmword [rsi]
movups xmmword [0x140189b28], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [0x140189b38], xmm1
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r14
mov byte [rsi], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14017be6d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017be68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017be68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
mov rdx, r15
cmp qword [0x140189b40], 0x10
cmovae rdx, qword [0x140189b28]
mov r8, qword [0x140189b38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017fe10
mov r13, qword [0x140189b38]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x37
jb 0x14017c8f9
mov rax, r15
cmp qword [0x140189b40], 0x10
cmovae rax, qword [0x140189b28]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
lea r12, [r13 + 0x37]
lea rsi, [rbp + 0x20]
mov edx, 0x16
cmp r12, 0xf
jbe 0x14017bf61
mov r14, r12
or r14, 0xf
cmp r14, rcx
jbe 0x14017bf25
mov r14, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140181160
test rax, rax
je 0x14017c28a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rbp - 8]
jmp 0x14017bf5d
cmp r14, rdx
cmovb r14, rdx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14017bf48
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14017c8df
jmp 0x14017bf02
test rcx, rcx
je 0x14017bf5b
call fcn.140181160
mov rsi, rax
mov rax, qword [rbp - 8]
jmp 0x14017bf5d
xor esi, esi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r14
mov r8, r13
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.librariescommojang_authlib1.5.25_authlib_1.5.25.jar]
movups xmmword [rsi + r13], xmm0
movups xmm1, xmmword [0x140183ee8]
movups xmmword [rsi + r13 + 0x10], xmm1
movups xmm0, xmmword [0x140183ef8]
movups xmmword [rsi + r13 + 0x20], xmm0
mov eax, dword [0x140183f08]
mov dword [rsi + r13 + 0x30], eax
movzx eax, word [0x140183f0c]
mov word [rsi + r13 + 0x34], ax
movzx eax, byte [0x140183f0e]
mov byte [rsi + r13 + 0x36], al
mov byte [rsi + r12], 0
or ebx, 0x20
mov rdx, qword [0x140189bb8]
cmp rdx, 0x10
jb 0x14017c00a
mov rcx, qword [0x140189ba0]
inc rdx
cmp rdx, 0x1000
jb 0x14017c005
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017c28a
mov rcx, r8
call fcn.1401813ec
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [0x140189ba0], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [0x140189bb0], xmm1
lea rsi, [0x140189ba0]
mov rcx, rsi
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rcx, rdx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r15
call fcn.14017a490
test al, al
je 0x14017c145
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x120]
call fcn.140181e64
cmp qword [0x140189bb8], 0x10
cmovae rsi, qword [0x140189ba0]
mov r8d, 0x22
mov rdx, rsi
lea rcx, [rbp + 0x120]
call fcn.14017d620
nop
cmp qword [rbp + 0x1a8], 0
je 0x14017c0ed
mov r8, qword [0x140189b70]
mov rdx, qword [0x140189b68]
sub r8, rdx
lea rcx, [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x128]
call fcn.14017ddb0
test rax, rax
jne 0x14017c0ed
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call fcn.14017d5b0
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov dword [rbp + 0x58], 1
lea rdx, str._n1.4399_n2.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
lea rdx, [rbp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rbp + 0x58], 1
sete al
mov byte [0x140189068], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x60], al
xor r13d, r13d
mov qword [rbp + 0x68], r13
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
test al, al
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARENeteasePC4399_MCLauncher
jne 0x14017c1b9
lea rdx, str.SOFTWARENeteaseMCLauncher
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x60]
call fcn.140179250
nop
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x60]
call fcn.140179370
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x60]
call fcn.140179250
nop
lea rax, str.PC4399_WPFLauncher.exe
lea rdx, str.WPFLauncher.exe
cmp byte [rbp + 0x60], 0
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14017c220
lea rcx, [rbp + 0x20]
call fcn.14017f130
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp + 0x100]
call fcn.14017e3b0
or ebx, 8
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14017c297
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017c291
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017c291
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1401813ec
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14017c2da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017c2d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017c2d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401813ec
movdqa xmm0, xmmword [0x1401842b0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r13w
lea rax, str.PC4399_WPFLauncher
lea rdx, str.WPFLauncher
cmp byte [rbp + 0x60], 0
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14017c320
lea rcx, [rbp + 0xe0]
call fcn.14017f130
or ebx, 0x10
lea rax, [rbp + 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8d, 4
lea rdx, [0x140183f28]
lea rcx, [rbp + 0x20]
call fcn.14017f130
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x60]
call fcn.14017d810
nop
lea rdx, [rbp + 0x20]
mov rcx, rax
call fcn.140178e40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x234], xmm0
movups xmmword [rbp + 0x244], xmm0
movups xmmword [rbp + 0x254], xmm0
movups xmmword [rbp + 0x264], xmm0
movups xmmword [rbp + 0x274], xmm0
movups xmmword [rbp + 0x284], xmm0
mov dword [rbp + 0x294], eax
mov dword [rbp + 0x230], 0x68
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14017c8bd
lea rdx, [0x140183f38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
xor sil, sil
nop dword [rax]
lea rdx, [0x140183f58]
lea rcx, [0x140183f68]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14017c472
lea rdx, [0x140183f70]
lea rcx, [0x140183f68]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14017c4b9
lea rdx, [0x140183fd4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov rcx, rax
lea rdx, [0x140183fc8]
call fcn.14017e700
mov rcx, rax
lea rdx, [0x140183fb0]
call fcn.14017e700
mov rcx, rax
lea rdx, [0x140183f88]
call fcn.14017e700
test sil, sil
sete sil
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
test sil, sil
je 0x14017c440
call fcn.14017a8f0
lea rdx, [0x140183fe0]
lea rcx, str.LWJGL
call qword [sym.imp.USER32.dll_FindWindowW]
mov dword [rbp - 0x10], r13d
test rax, rax
jne 0x14017c53f
lea rdx, [0x140184008]
lea rcx, str.LWJGL
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14017c53f
lea rdx, str.Cant_See_Minecraft_Window
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp - 0x10]
test r8d, r8d
jne 0x14017c58c
lea rdx, str.Cant_See_Minecraft_Window
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rsi, [0x140189b80]
mov rcx, rsi
cmp qword [0x140189b98], 0x10
cmovae rcx, qword [0x140189b80]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x14017c5e0
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
cmp qword [0x140189b98], 0x10
jb 0x14017c622
mov rsi, qword [0x140189b80]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14017c617
jmp 0x14017c62b
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14017c622
mov qword [rsp + 0x20], r13
mov r9, rdi
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x14017c69e
lea rdx, str.Cant_Run_Minecraft
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
lea rdx, [0x14017e8d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14018407c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14017c6df
nop dword [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14018407c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14017c6c0
lea rdx, [0x140184088]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017e700
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rsi, str.C:_shellcodeRunner.dll
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1401809ec
mov qword [rbp - 0x80], rsi
mov edi, 0x16
mov qword [rbp - 0x78], rdi
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1401794c0
or ebx, 0xc0
or ebx, 1
mov dword [rbp - 8], ebx
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.14017a260
movsd xmm0, qword [rax]
movsd qword [rbp - 0x30], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x60], ecx
lea rax, [0x140189048]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x90], xmm0
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x14017c7f2
cmp eax, 1
je 0x14017c7fa
call fcn.1401809ec
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp + 0x20]
call fcn.1401794c0
or ebx, 0x300
or ebx, 2
mov dword [rbp - 8], ebx
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14017a260
movsd xmm0, qword [rax]
movsd qword [rbp - 0x40], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rbp - 0x40]
test edx, edx
je 0x14017c7d4
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x14017c8ff
cmp ecx, 2
jne 0x14017c7fa
lea rdx, [0x14018407c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14017c7fa
mov dil, 1
jmp 0x14017c7fd
test ecx, ecx
jne 0x14017c8c6
xor dil, dil
test bl, 2
je 0x14017c852
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14017c841
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017c83c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017c8af
call fcn.1401813ec
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
test bl, 1
je 0x14017c898
and ebx, 0xfffffffe
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14017c898
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017c893
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017c8b6
call fcn.1401813ec
test dil, dil
je 0x14017c704
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14017c704
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x90]
lea rcx, str.exists
call fcn.14017a200
nop
call fcn.1401785c0
int3
mov r8, rsi
lea rdx, [rbp]
lea rcx, str.exists
call fcn.14017a200
int3
call fcn.140178660
nop
lea r8, [rbp + 0x20]
lea rcx, str.status
call fcn.14017a190
int3