Function at 0x14001f4f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xf8
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rbp - 1], rax
mov rsi, r9
mov r15d, r8d
mov r13, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov r14, qword [rbp + 0x7f]
cmp r8d, 0x113
ja 0x14001fd58
je 0x14001fb09
cmp r8d, 0x10
ja 0x14001f5f7
je 0x14001f5eb
mov eax, r8d
sub eax, 2
je 0x14001f5de
sub eax, 1
je 0x14001f58b
cmp eax, 0xc
jne 0x14001fd78
lea rdx, [rbp - 0x51]
mov rcx, r13
call qword [sym.imp.USER32.dll_BeginPaint]
lea rdx, [rbp - 0x51]
mov rcx, r13
call qword [sym.imp.USER32.dll_EndPaint]
jmp 0x14001fde4
cmp qword [rcx + 0x400], r12
je 0x14001fde4
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x44]
sub eax, r8d
mov r9d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
sub r9d, edx
mov rcx, qword [rdi + 0x400]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x14001fde4
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x14001fde4
mov dl, 1
call fcn.14001fe20
jmp 0x14001fde4
cmp r15d, 0x20
je 0x14001fae2
cmp r15d, 0x111
jne 0x14001fd78
cmp rsi, 0xa4
ja 0x14001f6bc
je 0x14001f6a9
mov rax, rsi
sub rax, 0x8e
je 0x14001f67f
sub rax, 2
je 0x14001f663
sub rax, 0x10
je 0x14001f653
cmp rax, 2
jne 0x14001fab0
lea edx, [rax - 1]
call fcn.14001ffe0
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
xor edx, edx
call fcn.14001ffe0
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
mov rax, qword [rcx + 0x90]
movzx edx, byte [rax + 0x82]
call fcn.14001f2b0
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
mov rax, qword [rcx + 0x88]
cmp byte [rax + 0x82], r12b
setne r12b
add rcx, 0x270
mov edx, r12d
call fcn.140012f50
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
mov edx, 2
call fcn.14001ffe0
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
cmp rsi, 0xa5
je 0x14001fabe
cmp rsi, 0x185
je 0x14001fa34
cmp rsi, 0xc355
jne 0x14001fab0
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x79], 0xf
mov byte [rsp + 0x50], r12b
xor r8d, r8d
lea rdx, [0x140026c82]
lea rcx, [rsp + 0x50]
call fcn.140001a10
nop
cmp dword [0x1400344f0], 2
jne 0x14001f720
cmp byte [0x1400340df], 0
je 0x14001f8c1
mov rdi, qword [0x140034480]
test rdi, rdi
je 0x14001f8c1
lea rbx, [0x140034470]
mov r14, qword [0x140034488]
mov rcx, rbx
cmp r14, 0x10
cmovae rcx, qword [0x140034470]
mov qword [rsp + 0x20], 4
lea r9, str.http
xor r8d, r8d
mov rdx, rdi
call fcn.140001300
cmp rax, 0xffffffffffffffff
jne 0x14001f8a0
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], 0xf
mov byte [rbp - 0x71], 0
mov dword [rsp + 0x40], 1
lea rdx, [rdi + 0x1e]
lea rcx, [rbp - 0x71]
call fcn.140006330
mov r8d, 0x1e
lea rdx, str.http:__bbs.3dmgame.com_thread_
lea rcx, [rbp - 0x71]
call fcn.1400062b0
cmp qword [0x140034488], 0x10
cmovae rbx, qword [0x140034470]
mov r8, qword [0x140034480]
mov rdx, rbx
lea rcx, [rbp - 0x71]
call fcn.1400062b0
mov r8d, 9
lea rdx, str._1_1.html
lea rcx, [rbp - 0x71]
call fcn.1400062b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x79]
cmp rdx, 0x10
jb 0x14001f84f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022b54
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x14001f984
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f896
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022b54
jmp 0x14001f984
cmp r14, 0x10
cmovae rbx, qword [0x140034470]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140001a10
jmp 0x14001f984
mov rdx, qword [0x1400344e0]
test rdx, rdx
je 0x14001f984
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], 0xf
mov byte [rbp - 0x71], 0
mov dword [rsp + 0x40], 4
add rdx, 0x1c
lea rcx, [rbp - 0x71]
call fcn.140006330
mov r8d, 0x1c
lea rdx, str.http:__flingtrainer.com_tag_
lea rcx, [rbp - 0x71]
call fcn.1400062b0
lea rdx, [0x1400344d0]
cmp qword [0x1400344e8], 0x10
cmovae rdx, qword [0x1400344d0]
mov r8, qword [0x1400344e0]
lea rcx, [rbp - 0x71]
call fcn.1400062b0
mov rdx, qword [rbp - 0x79]
cmp rdx, 0x10
jb 0x14001f972
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f96d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f96d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140022b54
movups xmm0, xmmword [rbp - 0x71]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbp - 0x61]
movups xmmword [rsp + 0x60], xmm1
lea rcx, [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rbp - 0x79]
cmp rdi, 0x10
cmovae rcx, rbx
mov qword [rsp + 0x20], 4
lea r9, str.http
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
call fcn.140001300
cmp rax, 0xffffffffffffffff
je 0x14001f9ed
lea r8, [rsp + 0x50]
cmp rdi, 0x10
cmovae r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdi, qword [rbp - 0x79]
mov rbx, qword [rsp + 0x50]
cmp rdi, 0x10
jb 0x14001fd78
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001fa23
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fa23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140022b54
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
cmp dword [0x1400344f0], 2
jne 0x14001fa46
lea r8, str.https:__flingtrainer.com_donation
jmp 0x14001fa96
lea rbx, [0x140033048]
mov rdi, qword [0x140033060]
mov rcx, rbx
mov r14, qword [0x140033048]
cmp rdi, 0x10
cmovae rcx, r14
mov qword [rsp + 0x20], 4
lea r9, str.http
xor r8d, r8d
mov rdx, qword [0x140033058]
call fcn.140001300
cmp rax, 0xffffffffffffffff
je 0x14001fab0
cmp rdi, 0x10
cmovae rbx, r14
mov r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r9, qword [rbp + 0x7f]
mov edx, 0x111
jmp 0x14001fdea
mov dl, 1
call fcn.14001fe20
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14001fafb
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x14001fdf6
mov r9, qword [rbp + 0x7f]
mov edx, 0x20
jmp 0x14001fdea
mov rax, rsi
sub rax, 0x2710
je 0x14001fcf7
sub rax, 1
je 0x14001fced
sub rax, 1
je 0x14001fc4c
sub rax, 1
je 0x14001fc26
cmp rax, 1
je 0x14001fb4a
mov r9, qword [rbp + 0x7f]
mov edx, 0x113
jmp 0x14001fdea
cmp byte [rcx + 0x3f8], r12b
sete al
mov byte [rcx + 0x3f8], al
mov ecx, 0x1000
call fcn.1400230ac
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp byte [rdi + 0x3f8], 0
je 0x14001fb88
lea r9, [rdi + 0x358]
cmp qword [r9 + 0x18], 8
jb 0x14001fb8f
mov r9, qword [r9]
jmp 0x14001fb8f
lea r9, [0x140026b90]
lea rax, [0x140034430]
cmp qword [0x140034448], 8
cmovae rax, qword [0x140034430]
lea r8, [0x140034250]
cmp qword [0x140034268], 8
cmovae r8, qword [0x140034250]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + 0x138]
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, rbx
call fcn.14001ab70
mov rcx, qword [rdi + 0xb8]
add rcx, 0x48
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14001fbf0
mov rdx, rbx
call fcn.1400022e0
movzx edx, byte [rdi + 0x58]
mov rcx, rdi
call fcn.140017130
nop
test rbx, rbx
je 0x14001fde4
mov rcx, rbx
call fcn.140022b54
jmp 0x14001fde4
mov rax, qword [rcx + 0xc0]
mov byte [rax + 0x8c], 5
mov dword [rax + 0x88], 2
movzx edx, byte [rcx + 0x58]
call fcn.140017130
jmp 0x14001fde4
mov ecx, 0x11
call qword [0x140033fd8]
shr eax, 0xf
test al, 1
je 0x14001fccf
mov ecx, 0x10
call qword [0x140033fd8]
shr eax, 0xf
test al, 1
je 0x14001fccf
mov ecx, 0x24
call qword [0x140033fd8]
shr eax, 0xf
and al, 1
je 0x14001fcc9
cmp byte [0x140034004], r12b
jne 0x14001fcc9
mov byte [0x140034004], 1
movzx ebx, byte [rdi + 0x3f9]
test bl, bl
sete al
mov byte [rdi + 0x3f9], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
neg bl
sbb rcx, rcx
add rcx, 0x96
mov r8d, 0x40005
call qword [sym.imp.WINMM.dll_PlaySoundW]
jmp 0x14001fccf
mov byte [0x140034004], al
cmp byte [rdi + 0x3f9], r12b
je 0x14001fde4
lea rcx, [rdi + 0xe8]
call fcn.140014080
jmp 0x14001fde4
call fcn.140020460
jmp 0x14001fde4
movzx eax, byte [rcx + 0x58]
cmp al, 0xfa
jae 0x14001fd03
mov bl, 5
jmp 0x14001fd08
movzx ebx, al
not bl
add bl, al
mov byte [rcx + 0x58], bl
movzx edx, bl
call fcn.140017130
mov rcx, qword [rdi + 0x400]
test rcx, rcx
je 0x14001fd3a
mov r9d, 3
movzx r8d, bl
mov edx, 0xff00ff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
cmp byte [rdi + 0x58], 0xff
jne 0x14001fde4
mov edx, 0x2710
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x14001fde4
mov eax, r15d
sub eax, 0x200
je 0x14001fdce
sub eax, 1
je 0x14001fdb6
sub eax, 1
je 0x14001fd9e
sub eax, 3
je 0x14001fd86
cmp eax, 0x9e
je 0x14001fd7e
mov r9, qword [rbp + 0x7f]
jmp 0x14001fde7
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001fde4
mov r9, qword [rcx]
mov rax, r14
shr rax, 0x10
movsx r8d, ax
movsx edx, r14w
call qword [r9 + 0x28]
jmp 0x14001fde4
mov r9, qword [rcx]
mov rax, r14
shr rax, 0x10
movsx r8d, ax
movsx edx, r14w
call qword [r9 + 0x20]
jmp 0x14001fde4
mov r9, qword [rcx]
mov rax, r14
shr rax, 0x10
movsx r8d, ax
movsx edx, r14w
call qword [r9 + 0x18]
jmp 0x14001fde4
mov r10, qword [rcx]
mov rax, r14
shr rax, 0x10
movsx r8d, ax
movsx edx, r14w
call qword [r10 + 0x10]
mov r9, r14
mov edx, r15d
mov r8, rsi
mov rcx, r13
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140022b30
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret