Function at 0x1400d18f0
Capabilities:
Create thread
Download url
Execute command
Get session user name
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3b0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140157dc0]
xor rax, rsp
mov qword [rbp + 0x280], rax
xor r12d, r12d
lea edx, [r12 + 1]
lea rcx, [0x1400c3d10]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.1400c6840
lea rcx, str.Color_0A
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x80], 0x101
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400d19a2
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rax, [rbp + 0x170]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x1400d1990
lea rdx, [rbp + 0x170]
jmp 0x1400d19f2
lea rdx, str.Kullan
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011c30
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140024f80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
xor r8d, r8d
lea rdx, [0x1400f5051]
lea rcx, [rbp - 0x60]
call fcn.140012fd0
nop
cmp qword [rbp - 0x50], 0
jne 0x1400d1a7a
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400d1a3e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d1a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d2793
call fcn.1400d34b8
xor eax, eax
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400d35d0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400ceb20
nop
mov ecx, 8
call fcn.1400d347c
test rax, rax
je 0x1400d1a9b
lea rcx, [0x1400cf890]
mov qword [rax], rcx
jmp 0x1400d1a9e
mov rax, r12
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14001aff0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400d27d0
mov ecx, 8
call fcn.1400d347c
test rax, rax
je 0x1400d1aed
lea rcx, [0x1400c87f0]
mov qword [rax], rcx
jmp 0x1400d1af0
mov rax, r12
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14001aff0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x1400d279a
call fcn.1400c9070
cmp byte [0x1401609f0], 0
jne 0x1400d1b59
mov edx, 4
lea rcx, str.Failed_to_edit_Hosts_File_n
call fcn.1400bdda0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d2738
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.14002bd20
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x1400d1c02
lea rax, [r8 + 9]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400d1b96
mov rdi, qword [rbx]
lea rax, [0x1400f4e31]
mov r15d, 9
lea r14, str.C:Users_
cmp rax, rdi
jbe 0x1400d1bca
lea rax, [rdi + r8]
cmp r14, rax
ja 0x1400d1bca
cmp rdi, r14
ja 0x1400d1bc2
mov rsi, r12
jmp 0x1400d1bcd
mov rsi, rdi
sub rsi, r14
jmp 0x1400d1bcd
mov rsi, r15
inc r8
lea rcx, [rdi + 9]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 9]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400d1c30
mov r15d, 9
mov qword [rsp + 0x28], r15
lea r14, str.C:Users_
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov edx, r15d
mov rcx, rbx
call fcn.14001c9b0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rbx + 0x10], r12
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x18], rdi
mov byte [rbx], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0x28
jb 0x1400d1cb0
lea rax, [rcx + 0x28]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, rdi
cmova rbx, qword [rsp + 0x60]
add rbx, rcx
lea r8d, [rdi + 0x19]
lea rdx, str.AppDataLocalGrowtopiainterfacelarge
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
lea rax, [rsp + 0x60]
jmp 0x1400d1cd5
mov qword [rsp + 0x20], 0x28
lea r9, str.AppDataLocalGrowtopiainterfacelarge
movzx r8d, byte [rsp + 0x30]
mov edx, 0x28
lea rcx, [rsp + 0x60]
call fcn.140006d50
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x80], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.140007320
nop
lea rcx, [rsp + 0x38]
call fcn.140007320
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
mov r8d, 0x46
lea rdx, str.https:__github.com_dorukalak_kingdomrttex_raw_main_kingdom_trick.rttex
lea rcx, [rbp + 0x150]
call fcn.140012fd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
mov r8d, 0x47
lea rdx, str.https:__github.com_dorukalak_kingdomrttex_raw_main_kingdom_casino.rttex
lea rcx, [rbp + 0x130]
call fcn.140012fd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
mov r8d, 0x47
lea rdx, str.https:__github.com_dorukalak_kingdomrttex_raw_main_kingdom_visual.rttex
lea rcx, [rbp + 0x110]
call fcn.140012fd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
mov r8d, 0x46
lea rdx, str.https:__github.com_dorukalak_kingdomrttex_raw_main_kingdom_other.rttex
lea rcx, [rbp + 0xf0]
call fcn.140012fd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
mov r8d, 0x42
lea rdx, str.https:__github.com_dorukalak_rabbit_raw_main_rabit_20general.rttex
lea rcx, [rbp + 0xd0]
call fcn.140012fd0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
mov r8d, 0x49
lea rdx, str.https:__github.com_dorukalak_kingdomrttex_raw_main_kingdombanner123.rttex
lea rcx, [rbp + 0xb0]
call fcn.140012fd0
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq rsi, xmm6
sub rax, rsi
mov qword [rbp - 0x80], rax
cmp rax, 0xc
jb 0x1400d27df
lea rax, [rbp + 0x80]
movq r12, xmm7
psrldq xmm6, 8
movq r13, xmm6
cmp r13, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea r15, [rsi + 0xc]
mov rbx, rdi
lea r14, [rbp + 0x60]
movabs rdx, 0x8000000000000000
mov r8d, reloc.WS2_32.dll_shutdown
cmp r15, rbx
jbe 0x1400d1f11
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400d1ecc
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d1eef
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d1f0d
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400d1ef6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27ac
jmp 0x1400d1eac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d1f0a
call fcn.1400d347c
mov r14, rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d1f0d
xor r14d, r14d
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], rbx
mov r8, rsi
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._trick.rttex]
movsd qword [rsi + r14], xmm0
mov eax, dword [0x14011a388]
mov dword [rsi + r14 + 8], eax
mov byte [r14 + r15], 0
cmp qword [rbp - 0x80], 0xd
jb 0x1400d27e5
lea rax, [rbp + 0x80]
cmp r13, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea r15, [rsi + 0xd]
mov rbx, rdi
lea r14, [rbp + 0x40]
cmp r15, rbx
jbe 0x1400d2019
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400d1fce
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d1ff7
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d2015
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400d1ffe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27b2
jmp 0x1400d1fae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d2012
call fcn.1400d347c
mov r14, rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d2015
xor r14d, r14d
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], rbx
mov r8, rsi
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.casino.rttex]
movsd qword [r14 + rsi], xmm0
mov eax, dword [0x14011a398]
mov dword [r14 + rsi + 8], eax
movzx eax, byte [0x14011a39c]
mov byte [r14 + rsi + 0xc], al
mov byte [r14 + r15], 0
lea rax, [rbp + 0x80]
cmp r13, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov rbx, rdi
lea r14, [rbp + 0x20]
cmp r15, rbx
jbe 0x1400d211e
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400d20d3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d20fc
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d211a
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400d2103
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27b8
jmp 0x1400d20b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d2117
call fcn.1400d347c
mov r14, rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d211a
xor r14d, r14d
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
mov r8, rsi
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._visual.rttex]
movsd qword [r14 + rsi], xmm0
mov eax, dword [0x14011a3a8]
mov dword [r14 + rsi + 8], eax
movzx eax, byte [0x14011a3ac]
mov byte [r14 + rsi + 0xc], al
mov byte [r14 + r15], 0
lea rax, [rbp + 0x80]
cmp r13, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
lea r15, [rsi + 0xc]
mov rbx, rdi
lea r14, [rbp]
cmp r15, rbx
jbe 0x1400d2227
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400d21dc
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d2205
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d2223
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400d220c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27be
jmp 0x1400d21bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d2220
call fcn.1400d347c
mov r14, rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d2223
xor r14d, r14d
mov qword [rbp], r14
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rbx
mov r8, rsi
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.other.rttex]
movsd qword [r14 + rsi], xmm0
mov eax, dword [0x14011a3b8]
mov dword [r14 + rsi + 8], eax
mov byte [r14 + r15], 0
cmp qword [rbp - 0x80], 0xe
jb 0x1400d27eb
lea rax, [rbp + 0x80]
cmp r13, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea r15, [rsi + 0xe]
mov rbx, rdi
lea r14, [rbp - 0x20]
cmp r15, rbx
jbe 0x1400d232f
mov rbx, r15
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400d22e4
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d230d
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d232b
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400d2314
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27c4
jmp 0x1400d22c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400d2328
call fcn.1400d347c
mov r14, rax
mov rax, qword [rsp + 0x60]
jmp 0x1400d232b
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rbx
mov r8, rsi
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.general.rttex]
movsd qword [r14 + rsi], xmm0
mov eax, dword [0x14011a3c8]
mov dword [r14 + rsi + 8], eax
movzx eax, word [0x14011a3cc]
mov word [r14 + rsi + 0xc], ax
mov byte [r14 + r15], 0
cmp qword [rbp - 0x80], 0x10
jb 0x1400d27f1
lea r15, [rbp + 0x80]
cmp r13, 0xf
cmova r15, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r14, [rsi + 0x10]
lea rbx, [rbp - 0x40]
cmp r14, 0xf
jbe 0x1400d242f
mov rdi, r14
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x1400d23f1
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d347c
test rax, rax
je 0x1400d268e
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400d242b
cmp rdi, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400d241a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400d27ca
jmp 0x1400d23d2
test rcx, rcx
je 0x1400d2429
call fcn.1400d347c
mov rbx, rax
jmp 0x1400d242b
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._bannernew.rttex]
movups xmmword [rsi + rbx], xmm0
mov byte [rbx + r14], 0
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r8, qword [rbp + 0x60]
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rdx, qword [rbp + 0x150]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r8, qword [rbp + 0x40]
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rdx, qword [rbp + 0x130]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova r8, qword [rbp + 0x20]
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova rdx, qword [rbp + 0x110]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rdx, qword [rbp + 0xf0]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r8, qword [rbp - 0x40]
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
call fcn.140048ec0
cmp dword [rbp - 0x68], ebx
je 0x1400d27f7
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400d27f7
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
call fcn.140010c00
mov rcx, qword [0x140160d08]
call fcn.1400a9810
mov rcx, qword [0x140160d08]
call fcn.1400a5f90
test al, al
je 0x1400d264a
lea rcx, str.Color_09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Server__client_proxy_is_running._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011c30
lea rdx, str.You_can_now_connect_to_Growtopia_n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011c30
lea edx, [rbx + 0xe]
lea rcx, str.If_Proxy_doesnt_connect_restart_Growtopia_n
call fcn.1400bdda0
mov rcx, qword [0x140160d08]
call fcn.1400975e0
call fcn.1400c3ef0
mov qword [rsp + 0x60], 5
lea rcx, [rsp + 0x60]
call fcn.140029db0
jmp 0x1400d2624
mov edx, 4
lea rcx, str.Failed_to_start_server_or_proxy._n
call fcn.1400bdda0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400d269a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d2695
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d2695
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d34b8
movdqa xmm0, xmmword [0x1400f4b10]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x20]
call fcn.140007320
nop
lea rcx, [rbp]
call fcn.140007320
nop
lea rcx, [rbp + 0x20]
call fcn.140007320
nop
lea rcx, [rbp + 0x40]
call fcn.140007320
nop
lea rcx, [rbp + 0x60]
call fcn.140007320
nop
lea rcx, [rbp + 0xb0]
call fcn.140007320
nop
lea rcx, [rbp + 0xd0]
call fcn.140007320
nop
lea rcx, [rbp + 0xf0]
call fcn.140007320
nop
lea rcx, [rbp + 0x110]
call fcn.140007320
nop
lea rcx, [rbp + 0x130]
call fcn.140007320
nop
lea rcx, [rbp + 0x150]
call fcn.140007320
nop
lea rcx, [rbp + 0x80]
call fcn.140007320
nop
cmp dword [rbp + 0xa8], 0
je 0x1400d2748
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rbp - 0x68], 0
je 0x1400d2755
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400d1a3e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d1a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d1a39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp + 0xa8], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140007c00
nop
call fcn.140007c00
nop
call fcn.140007c00
nop
call fcn.140007c00
nop
call fcn.140007c00
nop
call fcn.140007c00
nop
mov dword [rbp - 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140007c20
nop
call fcn.140007c20
nop
call fcn.140007c20
nop
call fcn.140007c20
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3