Function at 0x140001e90
Capabilities:
Contain obfuscated stackstrings
Create thread
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140019430]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov edi, r9d
mov rbx, rcx
call fcn.140003d80
lea rax, [0x1400010d0]
xor esi, esi
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x60], 0x50
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
call qword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, 0xffffff
mov qword [rbp - 0x78], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x70], rax
lea rax, str.CheatWindow
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rax
mov eax, 0x10a
mov qword [rbp - 0x58], rsi
mov word [0x14001bad8], ax
mov eax, 0x17c
mov dword [rbp - 0x20], 0x6e6b6e75
mov dword [rbp - 0x1c], 0x636e776f
mov dword [rbp - 0x18], 0x74616568
mov dword [rbp - 0x14], 0x656d2e73
mov word [0x14001baa8], ax
mov dword [rbp - 0x10], 0x42202d20
mov dword [rbp - 0xc], 0x54203146
mov dword [rbp - 8], 0x6e696172
mov dword [rbp - 4], 0x2d207265
mov dword [rbp], 0x65705320
mov dword [rbp + 4], 0x31696465
mov word [rbp + 8], 0x33
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x140002884
movzx ecx, word [0x14001bad8]
movzx eax, word [0x14001baa8]
mov rdx, qword [rbp - 0x60]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea r8, [rbp - 0xd]
mov ecx, 0x20000
mov r9d, 0xcb0020
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov edx, edi
mov qword [0x14001bab8], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14001bab8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.FF_Blocker__UNSAFE_
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 2
mov qword [0x14001ba70], rax
mov rax, qword [0x14001bab8]
lea r8, str.Minimap_Cheat
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x1f
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 3
mov qword [0x14001ba80], rax
mov rax, qword [0x14001bab8]
lea r8, str.NameTags_Cheat
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x34
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 4
mov qword [0x14001ba98], rax
mov rax, qword [0x14001bab8]
lea r8, str.Always_Visible__FF_Risk_
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x49
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14001bab0], rax
mov rcx, qword [0x14001bab8]
lea edx, [rsi + 4]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 5
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.Name__FF_Risk_
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x5e
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [0x14001bab8]
lea edx, [rsi + 5]
mov qword [0x14001bad0], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 6
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.Health__FF_Risk_
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x73
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [0x14001bab8]
lea edx, [rsi + 6]
mov qword [0x14001ba60], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.Distance__FF_Risk_
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0x88
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [0x14001bab8]
lea edx, [rsi + 7]
mov qword [0x14001bac8], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 8
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
mov dword [rsp + 0x28], 0x9d
mov dword [rsp + 0x20], 0xa
mov r9d, 0x50000002
lea r8, str.Engine_Chams__FF_Risk_
lea rdx, str.button
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 9
mov qword [0x14001baa0], rax
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.NoRecoil
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0xb2
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0xa
mov qword [0x14001ba50], rax
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.AimAssist
lea rdx, str.button
mov r9d, 0x50000002
xor ecx, ecx
mov dword [rsp + 0x28], 0xc7
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
movss xmm0, dword [0x14001740c]
movss dword [0x14001bae4], xmm0
mov qword [rsp + 0x48], 0xb
mov qword [0x14001ba68], rax
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xfa
lea r8, str.AttractInput:_0.500
lea rdx, str.static
mov r9d, 0x50000000
xor ecx, ecx
mov dword [rsp + 0x28], 0xdb
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0xc
mov qword [0x14001ba78], rax
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea r8, str.AttractInput
lea rdx, str.msctls_trackbar32
mov r9d, 0x50000001
xor ecx, ecx
mov dword [rsp + 0x28], 0xec
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rsi + 1]
mov edx, 0x406
mov rcx, rax
mov r9d, 0x640000
mov qword [0x14001ba40], rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14001ba40]
lea r9d, [rsi + 5]
xor r8d, r8d
mov edx, 0x415
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14001ba40]
lea r8d, [rsi + 5]
xor r9d, r9d
mov edx, 0x414
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x405
mov rcx, qword [0x14001ba40]
lea r9d, [rsi + 0x32]
lea r8d, [rsi + 1]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
movss xmm0, dword [0x140017410]
movss dword [0x14001bae0], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0xd
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xfa
lea r8, str.AttractInputZoom:_0.550
lea rdx, str.static
mov r9d, 0x50000000
xor ecx, ecx
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0xe
mov qword [0x14001ba48], rax
mov rax, qword [0x14001bab8]
lea r8, str.AttractInputZoom
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xb9
lea rdx, str.msctls_trackbar32
mov r9d, 0x50000001
xor ecx, ecx
mov dword [rsp + 0x28], 0x116
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rsi + 1]
mov edx, 0x406
mov r9d, 0x640000
mov rcx, rax
mov qword [0x14001bae8], rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14001bae8]
lea r9d, [rsi + 5]
xor r8d, r8d
mov edx, 0x415
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14001bae8]
lea r8d, [rsi + 5]
xor r9d, r9d
mov edx, 0x414
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14001bae8]
lea r9d, [rsi + 0x2d]
lea r8d, [rsi + 1]
mov edx, 0x405
call qword [sym.imp.USER32.dll_SendMessageA]
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xfa
lea r8, str.Status:
lea rdx, str.static
mov r9d, 0x50000000
xor ecx, ecx
mov dword [rsp + 0x28], 0x137
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [rbp - 0x20], 0x2e777777
mov dword [rbp - 0x1c], 0x6e6b6e75
mov dword [rbp - 0x18], 0x636e776f
mov qword [0x14001ba90], rax
mov dword [rbp - 0x14], 0x74616568
mov dword [rbp - 0x10], 0x656d2e73
mov dword [rbp - 0xc], 0x53202d20
mov dword [rbp - 8], 0x64656570
mov dword [rbp - 4], 0x333169
mov byte [rbp], sil
mov qword [rsp + 0x58], rsi
mov rax, qword [0x14001bab8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x10
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xfa
lea r8, [rbp - 0x20]
lea rdx, str.static
mov r9d, 0x50000000
xor ecx, ecx
mov dword [rsp + 0x28], 0x150
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x11
mov qword [0x14001ba88], rax
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov dword [rbp + 8], eax
mov byte [rbp + 0xc], al
mov rax, qword [0x14001bab8]
lea r8, str.v1.0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x1e
lea rdx, str.static
mov r9d, 0x50000000
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0xdc
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001670]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140002880
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140002856
xor eax, eax
jmp 0x1400028b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_RegisterClassEx__0x_X__n
mov edx, eax
call fcn.1400040b8
lea rdx, str.Error_RegisterClassEx
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140003f10
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret